implementing-supply-chain-security-with-in-toto

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The pipeline example runs a runtime git clone of remote code (https://github.com/org/app.git) which will be built/executed in the CI steps, so this URL fetches remote content used at runtime that can cause execution of remote code.