yuv-reel-covers

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill dynamically imports and executes remote JavaScript at runtime (e.g., import("https://cdn.jsdelivr.net/npm/@imgly/background-removal@1.5.5/+esm") in cover-studio.html and ) and the headless generator invokes npx --yes hyperframes@latest (which fetches and runs remote npm code) — all clear, high-confidence runtime fetches that execute external code.