trufflehog-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install scripts download and verify TruffleHog release artifacts from the GitHub Releases URL (e.g., https://github.com/trufflesecurity/trufflehog/releases/download/v$Version and https://github.com/trufflesecurity/trufflehog/releases/download/v${VERSION}) at runtime, fetch executable archives and signatures, and then extract/install the binary (remote code execution dependency).