qualiobee

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running npx/npm to fetch and execute the @membranehq/cli package at runtime (e.g. npx @membranehq/cli@latest — package page: https://www.npmjs.com/package/@membranehq/cli), and that CLI/remote Membrane service will build and return actions (remote code/instructions) that directly control agent behavior, so the fetched content both executes and controls prompts at runtime.