mundi-qmd-secret-scan-precommit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's recommended .pre-commit-config.yaml references and will fetch/execute code from the external repo https://github.com/gitleaks/gitleaks at runtime (pre-commit installs and runs the gitleaks hook), so the URL is a required runtime dependency that executes remote code.