qmd-expert

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes the qmd CLI to fetch external content (e.g., qmd get "$chunk_id" and qmd get "$url") which pulls data from URIs like "qmd://url" at runtime and that fetched content is then used as agent context/prompt material, so it directly controls agent prompts.