skill-manager

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The Codex reference explicitly documents MCP tool endpoints that are invoked at runtime by skills (e.g., the MCP URLs like https://api.githubcopilot.com/mcp/ and https://mcp.figma.com/mcp are listed as the HTTPS endpoints used by dependencies.tools and thus would be contacted at runtime to provide tool outputs/control agent behavior).