alova-client-usage

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly instructs the agent to "Always fetch the official doc before answering" and includes runtime-facing links such as https://alova.js.org (and its subpages like https://alova.js.org/api/method), so fetching that external documentation at runtime would directly control the agent's responses.