wp-playground

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly allows fetching and executing remote blueprints and archives at runtime (e.g., passing --blueprint= or using https://playground.wordpress.net/?blueprint-url=…) and the blueprint examples show installing plugin/theme ZIPs from URLs such as https://downloads.wordpress.org/plugin/classic-editor.zip which can inject and execute PHP code inside the Playground, so this is a runtime external dependency that controls execution.