blaxel

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches tool definitions at runtime from a sandbox MCP server (e.g., https://<SANDBOX_URL>/mcp via bl_tools), and those remote tool definitions directly control agent tools/behavior and can trigger code execution, so this is a runtime external dependency.