dependency-search

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs fetching raw repository files at runtime (e.g., via the GitHub API endpoint gh api "repos///contents/?ref=" with Accept: application/vnd.github.raw), which will inject external repo content into the agent context and thus directly influence prompts and analysis.