runtype-persona

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill declares a runtime MCP dependency at https://api.runtype.com/v1/mcp/protocol (agents/openai.yaml) used to fetch embed/docs/snippets and lists CDN script URLs (e.g., https://cdn.jsdelivr.net/npm/@runtypelabs/persona@latest/dist/install.global.js and https://cdn.jsdelivr.net/npm/@runtypelabs/persona@latest/dist/index.js) that are loaded and execute as required widget assets, so external content is fetched at runtime and can execute code or control the produced embed/instructions.