analyze-code

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's MCP configuration and failure-mode examples show it invokes an external MCP server via npx for the Ref tool (args: ["-y", "@anthropic-ai/mcp-server-ref"] — e.g. https://www.npmjs.com/package/@anthropic-ai/mcp-server-ref), which would fetch and execute remote code at runtime and is used by the skill for required MCP verification.