mcp-ecosystem

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill config instructs the agent to call external MCP endpoints at runtime (e.g., https://mcp.context7.com/mcp and https://mcp.notion.com/mcp) and includes executable runtime commands that use npx to fetch and run remote packages (e.g., @modelcontextprotocol/server-postgres), so remote content can directly influence agent behavior and execute code.