claude-api

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime-managed-agent flows that declare remote MCP servers and mount GitHub repos (e.g., "https://my-mcp-server.example.com/sse", "https://api.github.com/mcp/", "https://api.githubcopilot.com/mcp/", and GitHub repo URLs like "https://github.com/owner/repo") which are fetched/attached at session runtime and can provide tools, code, or repositories that the agent will execute or use—so these external URLs directly influence prompts/tool execution during runtime.