canvas-workbench

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes package runners (e.g., npx @drupal-canvas/workbench, pnpm dlx @drupal-canvas/workbench, bunx @drupal-canvas/workbench, yarn dlx @drupal-canvas/workbench) which fetch and execute remote package code from the npm registry at runtime and are required to start the Workbench, so remote code execution is possible.