stelow-product-trust-building

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The files include explicit runtime install commands that fetch and run remote git-hosted packages (pi install git:github.com/cursor/plugins and pi install git:github.com/PriNova/pi-agent-codebase-workflows), which cause remote code to be fetched and executed at runtime.