pma-design

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). build-preview.mjs includes code that at runtime can fetch and evaluate remote JavaScript (via vendorFile/fetchText and new Function) — e.g. it will download and execute Babel from https://unpkg.com/@babel/standalone@7.29.0/babel.min.js if the local vendor copy is missing, so the skill can fetch and run remote code during execution.