bmad-loop-sweep

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The bmod.toml configuration file explicitly declares a GitHub repository locator (github:bmad-code-org/bmad-loop/src/bmad_loop/data/skills) for skill source material, which constitutes an operational remote dependency.