huashu-design

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's HTML/React runtime explicitly loads and executes remote JavaScript from unpkg (e.g. https://unpkg.com/react@18.3.1/..., https://unpkg.com/react-dom@18.3.1/..., https://unpkg.com/@babel/standalone@7.29.0/babel.min.js — and optionally https://unpkg.com/popmotion@11.0.5/...), which are fetched at runtime and are required dependencies for the generated prototypes, so they constitute runtime external code execution.