workos-api-roles

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to "WebFetch the relevant docs" (e.g., https://workos.com/docs/reference/roles), meaning external content from that URL is fetched during execution and used to drive how the agent proceeds, so it directly controls prompts/instructions.