stelow-product-marketplace-playbook

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). I flagged the explicit git install commands (pi install git:github.com/PriNova/pi-agent-codebase-workflows and pi install git:github.com/cursor/plugins) because they are runtime installation commands that fetch and install remote code which would execute on the agent host and are presented as required installs for the corresponding tools.