formio-mcp-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill config instructs the client to run npx to fetch-and-execute the remote package "@formio/mcp" (e.g., via "npx -y @formio/mcp"), which is a runtime external dependency that will retrieve and run remote code from the npm registry.