meta-repo

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly runs git clone/git operations against SSH git URLs at runtime (e.g., git@github.com:yourorg/my-meta-repo.git), which fetch remote repositories that the skill then operates on (meta exec, npm install, etc.), meaning those external URLs are used at runtime and can lead to execution of remote code.