docker-expert

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The Dockerfile copies a binary from ghcr.io/astral-sh/uv:latest (COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv) and then runs it (RUN uv sync), so ghcr.io/astral-sh/uv:latest is fetched during build and executes remote code as a required dependency.