tycana

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires a runtime connection to the Tycana MCP server at https://app.tycana.com/mcp and states that "every session includes your tasks, projects, deadlines..." which indicates external content fetched from that URL is injected into sessions and thus can directly control prompts/instructions.