sap-dependency-security

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs a runtime source install and build of the SAC MCP from https://github.com/secondsky/sap_analytics_cloud_mcp (git clone ... && npm ci --ignore-scripts && npm run build), which fetches remote code and executes it as a required MCP dependency.