claude-api

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes explicit managed-agent/session examples that mount external code and tool endpoints at runtime (e.g., GitHub repo URLs like https://github.com/owner/repo and MCP endpoints like https://my-mcp-server.example.com/sse / https://api.githubcopilot.com/mcp/), which would cause remote content to be fetched into the agent workspace and could provide code or tools executed during a session.