research-codebase-readme-writer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The README's Setup section instructs to install a non-pip dependency via pip with a remote index URL (pip install torch-scatter -f https://data.pyg.org/whl/torch-2.0.0+cpu.html), which fetches and executes remote wheel code at install time and is presented as a required dependency.