hwp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs "git clone https://github.com/jkf87/hwp-mcp.git" and then installs its requirements (pip install -r requirements.txt), which fetches and installs remote code at runtime that will be executed as a required dependency, so this URL is a runtime remote-code execution risk.