creator-record-strategy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches wiki content at runtime (e.g., via the plugin bridge route POST /api/plugins/paperclipai.plugin-llm-wiki/data/page-content and SPA wiki URLs like https://paperclip.right.link/... which are retrieved using paperclip-wiki-fetch) and then "use[s] the markdown body as approved input" (directly controlling agent prompts), and it also runs remote code at runtime via npx -y @bbengamin/paperclip-mcp-server (an npm package), so these external fetch/exec steps meet the criteria for runtime dependencies that control prompts or execute code.