Yes, and since it's just a URL even if you perform an audit it could have malicious code injected at any time in the future without your knowledge.