wiki-code

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill issues runtime qmd get calls (e.g., qmd get qmd://peach-harness/skills/peach-setup-harness/skill.md) to fetch raw documents that are read into the agent context and can directly control prompts/instructions, so this external qmd:// URL is a required runtime dependency with potential for prompt injection.