gemini-api

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP example launches an external MCP server via runtime execution of "npx -y @philschmid/weather-mcp", which fetches and runs remote code that the agent uses as a tool to provide/shape prompts and responses, so it is a runtime external dependency that can directly control agent instructions.