entra-agent-id

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill’s runtime deployment and code patterns explicitly require pulling and running the sidecar container image at mcr.microsoft.com/entra-sdk/auth-sidecar:1.0.0-azurelinux3.0-distroless (present in the Docker Compose / Kubernetes manifests and referenced by SIDECAR_URL), which fetches and executes remote code as a required runtime dependency.