zed-extension-creator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The language-server template/code fetches and runs a GitHub release asset (repo "org/my-language-server" — assets/templates/language-server-lib.rs) and the MCP example runs an npm package via npx ("@org/my-mcp-server" — references/context-servers.md), both of which fetch and execute remote code at runtime; additionally grammars point at remote GitHub repos ("https://github.com/org/tree-sitter-my-language" — references/languages.md) which are fetched/compiled by Zed.