cali-ops-github-releases

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes runtime-executed external components: GitHub Actions references (actions/checkout@v4 and googleapis/release-please-action@v4) which are fetched and run by the runner, and it explicitly points to the gh-signoff extension (https://github.com/basecamp/gh-signoff) which the flow may install/run (gh extension install / gh signoff), so remote code is fetched and executed at runtime.