iblai-api-agent-embed

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The embed widget fetches mentor settings (including custom JavaScript) from the settings endpoint which the widget will execute at runtime — e.g. GET/PUT to https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/$MENTOR/settings/ provides custom_javascript that can execute remote code in the embed.