pgpm

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs show runtime commands like "pgpm init --repo https://github.com/org/templates.git" and "--repo constructive-io/sandbox-templates" which cause pgpm to fetch a remote template repository (which can include .boilerplate.json question configs and template code) at runtime and thus can directly control prompts and scaffolding behavior.