bilig-workpaper

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime commands that fetch and run remote content (npx add and remote MCP calls), specifically the npx add URL https://bilig.proompteng.ai and the MCP endpoints https://bilig.proompteng.ai/mcp and https://bilig.proompteng.ai/mcp/workpaper, which are used at runtime to provide tools/behavior and can execute remote code or control agent tooling.