doubaoya-gateway

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires fetching live API specs from https://doubaoya.com/api/apis// and https://doubaoya.com/api/skills/ at runtime to construct requests (the fetched inputContract/inputUiSchema directly controls how the agent builds prompts/parameters), so these remote endpoints are runtime dependencies that control agent behavior.