gstack

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains a runtime install step that downloads and executes the Bun installer (curl -fsSL "https://bun.sh/install" -o "$tmpfile" … bash "$tmpfile"), which fetches remote code at runtime and runs it, so this external URL directly results in executing remote code.