nix-best-practices

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The flake examples explicitly fetch remote binaries at build/runtime via pkgs.fetchurl from URLs such as "https://example.com/tool-linux-amd64-v${version}" (and the sibling example.com tool URLs), which bring remote executable code into the package as a required dependency.