Supply Chain Security

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes GitHub Actions and external repos that are fetched and executed during CI (e.g., google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main), so there are runtime external dependencies that execute remote code.