security-sbom

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions in SKILL.md reference external action repositories that are fetched and executed at CI runtime (e.g., "anchore/sbom-action@v0", "aquasecurity/trivy-action@master", "actions/checkout@v4", "actions/upload-artifact@v4"), which cause remote code to be run as required pipeline steps.