browser-qa

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires starting external MCP servers at runtime (e.g., running "npx @playwright/mcp@latest" and "npx chrome-devtools-mcp@latest") and even documents cloning and installing third‑party code via "git clone https://github.com/browser-use/browser-harness.git", which fetches and executes remote code that the agent relies on to control browsers—so these are runtime external dependencies that execute remote code.