{skill-name}

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The mcp-config samples show commands that run npx to fetch-and-execute remote npm packages at runtime ( "@trello/mcp-server", "@modelcontextprotocol/server-github", "@aspire/mcp-server" ) and the decisions note a runtime bootstrap that downloads executables from the published plugin repo (sbroenne/mcp-server-excel-plugins), so remote content is fetched and executed during runtime.