java-xxe-audit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's DECOMPILE_STRATEGY includes a runtime curl command to download and then execute a CFR JAR (java -jar), so the URL https://xget.xi-xu.me/gh/leibnitz27/cfr/releases/download/0.152/cfr-0.152.jar is a runtime external dependency that fetches and executes remote code required for the skill.