visual-creative-subagent

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The subagent explicitly verifies and then injects/executes CDN-hosted JavaScript libraries at runtime (the generated index.html and Playwright validation load scripts from the library-catalog entries — e.g., https://cdnjs.cloudflare.com/ajax/libs/d3/7.9.0/d3.min.js), so external code is fetched and executed and is a required dependency for the skill.