homebrew-formula-expert

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Claude Code Plugin formula includes a runtime-install URL (https://github.com/user/my-plugin/archive/refs/tags/v1.0.0.tar.gz) whose fetched archive is installed into libexec and symlinked into $HOME/.claude/plugins and then activated (via the included install/post_install steps and a claude plugin update), meaning remote code is fetched at install time and can be executed by the Claude agent—directly impacting agent behavior.