execution-grade-planning

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Phase 0 instructs the agent to "clone/fetch" user-specified repos at runtime (SKILL.md:41) and the referenced audit procedure explicitly uses "git clone https://github.com//.git" (references/codebase-audit-methodology.md:14), meaning external repo content could be fetched at runtime and those files (e.g., AGENTS.md or SKILL.md) might directly control prompts or agent behavior.