drawio-mcp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill declares DRAWIO_BASE_URL=https://embed.diagrams.net which is used at runtime to load the draw.io embed (remote JavaScript) into the browser — a required runtime dependency that executes remote code in the user's browser.