igrantio-dcql-query-loyalty-card

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL instructs operators to "Fetch the source directory" at runtime from the registry URLs https://github.com/decentralised-dataexchange/verifiable-data-registry/tree/main/presentationDefinitions/dcqlQuery/loyaltyCard and https://raw.githubusercontent.com/decentralised-dataexchange/verifiable-data-registry/main/presentationDefinitions/dcqlQuery/loyaltyCard/2025.7.1/dc%2Bsd-jwt.schema.json, and that fetched registry JSON is the authoritative source for claim paths so it directly controls what prompts/claims the agent requests.