motion-video-maker

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README's Quick Start tells agents to git clone and install the repository (git clone https://github.com/GordenSun/react-bits-video.git && npm install && node scripts/install-fonts.mjs), which fetches remote code and then runs local scripts / installs packages that will execute code from that remote source, so the https://github.com/GordenSun/react-bits-video.git URL is a runtime installation-time dependency that can lead to executing remote code.