hmos-jsleak-analysis

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's Step 0 explicitly instructs obtaining the missing runtime binary heap_cluster from https://gitcode.com/HarmonyOS_Skills/harmonyos-agent-skills.git and that fetched binary would be executed as a required runtime dependency, so the external git URL controls code run by the skill.