datagouv-apis

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly directs the agent to fetch live OpenAPI/Swagger specs at runtime (which the skill says are "authoritative" and must be trusted) — e.g. https://www.data.gouv.fr/api/1/swagger.json, https://metric-api.data.gouv.fr/api/doc, https://tabular-api.data.gouv.fr/api/doc — and the README also suggests pointing the model to the raw SKILL.md at https://raw.githubusercontent.com/datagouv/datagouv-skill/main/SKILL.md, all of which are runtime-fetched documents that directly control the agent's API-calling behavior and prompt/instruction interpretation.