cinematic-film

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill contains explicit URLs for fetching map data from jsdelivr.net (https://cdn.jsdelivr.net/npm/...), which acts as a third-party CDN transporter for third-party packages. Because jsdelivr is a transporter, we evaluate the publisher of the hosted packages (world-atlas and us-atlas), which are common open-source community repositories without strong first-party corporate provenance, making this a common/reputable unofficial operational dependency (medium tier).