formio-angular

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The BOOTSTRAP phase fetches unpinned package.json files from unpkg (https://unpkg.com/@formio/angular/package.json, https://unpkg.com/@formio/js/package.json, https://unpkg.com/bootstrap/package.json, https://unpkg.com/bootstrap-icons/package.json) to decide versions at runtime and runs npx against a remote repo (https://github.com/angular/skills) which installs/executes remote code — these runtime fetches and npx install directly control the agent's install/behavior choices.