cloudflare

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime MCP registration and tooling retrieval (e.g., registerServer/getAITools) that fetches tool definitions from an external MCP server URL (example: https://mcp.example.com via env.MCP_SERVER_URL), and those fetched tools are injected into the agent's prompt/tooling and thus can directly control agent instructions at runtime.