obsidian-plugin-release

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions referenced in the release workflows (e.g., uses: actions/checkout@v3, actions/setup-node@v3 / @v4, and softprops/action-gh-release@v2) fetch and execute remote action code from their repositories at workflow runtime (e.g., https://github.com/actions/checkout, https://github.com/actions/setup-node, https://github.com/softprops/action-gh-release), so these are required runtime dependencies that run external code.