claude-design

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's demo/prototype HTML loads unpkg-hosted JS at runtime (e.g., https://unpkg.com/react@18.3.1/umd/react.development.js, https://unpkg.com/react-dom@18.3.1/umd/react-dom.development.js, https://unpkg.com/@babel/standalone@7.29.0/babel.min.js), which are fetched and executed in the user's browser and are required for the prototypes to run, so they constitute runtime external code execution dependencies.