frappe-syntax-customapp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The documentation contains runtime commands that fetch and install remote Git repositories (e.g., https://github.com/org/my_custom_app and https://github.com/your-org/my_custom_app.git via "bench get-app"), which will download external code that can be executed during install/migrate (patches/hooks), so this is a runtime external dependency that can execute code.