sales-fastmail

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes setup instructions that fetch and run community MCP servers (e.g., git clone https://github.com/jmhron/FastMailMCP.git and running python server.py), which clearly fetches remote code that will be executed at runtime from the listed GitHub repositories (https://github.com/jmhron/FastMailMCP and https://github.com/MadLlama25/fastmail-mcp), so this is a runtime external dependency that can execute remote code.