bagisto-api-develop

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The manual install step explicitly instructs fetching the package from https://github.com/bagisto/bagisto-api (download/extract) and then running composer/php artisan commands, so this URL is used at runtime to retrieve remote code that will be executed as part of installation.