hiui-page-workflow

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The bundle lock and install scripts fetch and stage code from the upstream git repo https://github.com/XiaoMi/hiui.git at runtime (e.g., git clone in docs and scripts that call runGit/clone of entry.source.repoUrl), which can change the installed skill content that the agent will consume and thus can control prompts/behavior—so this runtime external dependency is flagged.