semgrep

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs scanner tasks to git-clone third-party Semgrep rulesets at runtime (e.g., https://github.com/trailofbits/semgrep-rules, https://github.com/0xdea/semgrep-rules, https://github.com/Decurity/semgrep-smart-contracts) and then uses those local clones as required --config inputs to semgrep, meaning remote content is fetched during execution and directly controls the scanner's behavior.