endor-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads and runs a binary from https://api.endorlabs.com (e.g., https://api.endorlabs.com/download/latest/ and checksum from https://api.endorlabs.com/sha/latest/) and also auto-fetches documentation at runtime from https://docs.endorlabs.com/endorctl/commands/scan/ to determine flags, so external content is fetched during runtime that both executes code and directly controls agent behavior.