motion-graphics

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The bake-basemap runtime loads and executes third-party JS and data (e.g. https://cdn.jsdelivr.net/npm/maplibre-gl@5.24.0/dist/maplibre-gl.js, https://cdn.jsdelivr.net/npm/topojson-client@3.1.0/dist/topojson-client.min.js and fetches https://cdn.jsdelivr.net/npm/world-atlas@2.0.2/countries-110m.json as well as external tile endpoints like https://server.arcgisonline.com/... and https://a.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}.png during the basemap bake (bake-basemap.mjs), which are fetched at runtime, execute remote code/assets in the headless page, and are required for the skill’s basemap baking step.