test-coverage

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs that if $TARGET_ZONE is a Jira URL (e.g., https://ledgerhq.atlassian.net/browse/LIVE-1234) it must fetch the ticket via Atlassian MCP at runtime and extract affected files to drive analysis and test-writing, meaning remote ticket content would directly control the agent's instructions and behavior.