hand-gesture-recognition

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill uses locateFile pointing to https://cdn.jsdelivr.net/npm/@mediapipe/hands/${file}, which at runtime fetches required MediaPipe model/WASM assets from jsDelivr that are downloaded and executed by the agent, so this is a runtime external dependency that can execute remote code.