mastra

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs runtime fetching of remote documentation (e.g., https://mastra.ai/llms.txt) and shows WebFetch examples that pull markdown into the agent context to drive API usage and prompts, so the externally fetched content can directly control agent instructions at runtime.