canvas

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs nodes at runtime to load and execute HTML/JS from URLs like http://:18793/openclaw/canvas/.html (e.g., http://peters-mac-studio-1.sheep-coho.ts.net:18793/__openclaw__/canvas/snake.html), which are fetched during runtime and can execute arbitrary JavaScript in the node WebViews.