dbt-core

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running "dbt deps" with packages listed in packages.yml (e.g., dbt-labs/dbt_utils, calogica/dbt_expectations, dbt-labs/codegen) which causes fetching and installing remote dbt package code from the dbt Hub/GitHub (e.g. https://hub.getdbt.com/dbt-labs/dbt_utils/latest/) that is then executed as macros during dbt runtime, meeting the criteria for external code fetched and executed at runtime.