macos-auto-update

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill configures Sparkle to fetch an appcast at runtime (SUFeedURL = https://raw.githubusercontent.com/OWNER/REPO/main/appcast.xml), and that remote appcast (and enclosed release URL like https://github.com/OWNER/REPO/releases/download/v1.2/YourApp.dmg) directly controls update prompts and the download/installation of remote code, so these runtime URLs are a high-confidence external control point.