crossplane

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill manifests include OCI/package registry and Git repo URLs that Crossplane/ArgoCD will fetch at runtime (e.g., xpkg.upbound.io/crossplane-contrib/provider-aws:v1.1.0, xpkg.upbound.io/my-org/function-custom-logic:v0.1.0, registry.example.com/platform/my-platform-config:v1.0.0, and https://github.com/myorg/crossplane-configs), and those package/repo contents are pulled and executed as provider controllers or function containers—i.e., remote code fetched at runtime that directly controls behavior.