ciscoxr

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The ZTP Python example downloads and applies remote configuration at runtime (os.system('curl -o /tmp/config.cfg http:///config.cfg') then 'configure replace /tmp/config.cfg' and 'commit'), and the platform upgrade example uses install add source tftp://server/image.tar.gz activate to fetch and install software—both are runtime fetches of external content that directly control device configuration or execute code (flagged URLs: http:///config.cfg and tftp:///image.tar.gz).