qa

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs a runtime curl download and then executes the fetched installer script (curl -fsSL "https://bun.sh/install" -o "$tmpfile" ... BUN_VERSION=... bash "$tmpfile"), so https://bun.sh/install is a runtime-fetched URL whose content is executed.