pluggy-doctor

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches Pluggy's docs at runtime (preferred MCP endpoint https://docs.pluggy.ai/mcp and the web fallback index https://docs.pluggy.ai/llms.txt and the referenced .md pages) and injects that content as the authoritative criteria controlling its diagnostics and generated prompts, so these URLs are runtime external dependencies that directly control agent behavior.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)