mastra

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to fetch and consume remote documentation (e.g., https://mastra.ai/llms.txt and other https://mastra.ai/*.md pages via WebFetch) to drive prompt content and code-writing decisions, so this external URL is used during runtime and can directly control agent instructions.