lynx-a2ui

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching the Lynx GenUI catalog at "https://unpkg.com/@lynx-js/genui/a2ui/dist/catalog.json" at runtime and treats that fetched JSON as the authoritative, dynamic schema that directly controls which components, props, enums, and actions the agent may emit, making it a required external dependency that directly controls agent behavior.