zig-build-system

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's package manifests and examples reference external tarball dependencies that are fetched at build time (e.g., https://github.com/zigzap/zap/archive/v0.1.0.tar.gz, https://github.com/MasterQ32/zig-network/archive/refs/tags/v0.6.0.tar.gz, https://github.com/org/repo/archive/v1.0.0.tar.gz), which will download remote code used/compiled in the build and therefore can result in executing remote code during runtime.