javascript-ecosystem

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly tells agents to fetch external agent-context files (e.g. "/llms.txt") and recommends installing/using official agent skills/MCP servers (e.g. "https://github.com/angular/skills", "svelte.dev/docs/mcp", "ai-sdk.dev/docs/getting-started/coding-agents"), which are runtime fetches that would directly supply prompts or agent guidance, so they are runtime external dependencies that can control prompts or execute fetched code.