forge-security-review

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The static analysis setup scripts fetch compiled FSRT scanner binaries from GitHub release URLs at runtime when not present, representing a weak/unknown operational dependency.