user-research-cookiy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The SKILL.md explicitly tells the agent to "fetch https://cookiy.ai/intro-for-agent.txt" at runtime, which means external text would be pulled into the agent context and could directly influence prompts/instructions.