scholar-evaluation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The generate_schematic scripts call the OpenRouter API at runtime (base_url: https://openrouter.ai/api/v1 — see https://openrouter.ai/keys), and the model responses (reviews/critique) are used to iteratively modify and control generation prompts, with an OPENROUTER_API_KEY required, so this external URL directly controls agent prompts and is a required runtime dependency.