gimp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The .codebuddy/mcp.json config invokes "npx -y @libreearth/gimp-mcp" (libreearth/gimp-mcp), which fetches and executes remote npm package code at runtime and is relied on as the MCP server dependency, so it is a runtime-fetched/executes-remote-code dependency.