framework-tutor

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The SKILL.md instructs the tutor to "use SCF crosswalk data from https://grcengclub.github.io/scf-api/" at runtime when no plugin exists, meaning remote content from that URL would be fetched and directly control the agent's output, so it is flagged.