audit-realworld

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to "fetch the current spec" and to use the hosted API and reference repo (e.g., api.realworld.show, realworld-apps/realworld, codebase.show/projects/realworld), meaning external content would be retrieved and used as the authoritative spec that directly controls audit decisions/prompts.