next-upgrade

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly tells the agent to WebFetch the official Next.js upgrade guides at runtime (e.g. https://nextjs.org/docs/app/guides/upgrading/codemods and https://nextjs.org/docs/app/guides/upgrading/version-16, version-15, version-14) and use that fetched documentation to determine migration steps, so remote content would directly control the agent's instructions.