aliyun-modelstudio-crawl-and-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow runs npx -y @just-every/crawl to fetch and parse https://help.aliyun.com/zh/model-studio/models at runtime and uses that fetched content to generate/update skills/ai/** (i.e., content directly controls generated agent skills), while npx also executes remote package code during the crawl, so this remote URL and the runtime remote package execution present a high-risk dependency.