lark-apps

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The creative-design skill includes required script/font URLs that are fetched and executed by generated HTML at runtime (e.g., https://sf3-scmcdn-cn.feishucdn.com/obj/feishu-static/miaoda/coding-unpkg-sdk/react@18.3.1/umd/react.development.js), and the agents explicitly load/evaluate the served pages (eval_js / webview), so these external assets are runtime dependencies that execute remote code.