yapi

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes remote code via "npx -y @leeguoo/yapi-mcp" (fetched from the npm registry at runtime) and also fetches raw JSON from the user-configured YApi base_url (from ~/.yapi/config.toml, e.g. the YApi server URL) which is injected into the agent for summarization, so both can execute remote code or directly control prompt content at runtime.