langfuse

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill initializes Langfuse with host="https://cloud.langfuse.com" and calls langfuse.get_prompt(...) at runtime, which fetches remote prompt content from that URL that is then compiled and used as LLM instructions, so https://cloud.langfuse.com is a runtime external dependency that directly controls prompts.