cli-design

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository references "github:metyatech/agent-rules@HEAD/rules/domains/skill/repository.md" (seen in AGENTS.md) which compose-agentsmd is invoked to fetch at runtime (pre-commit, CI, and the agent session gate) and those fetched rules directly control agent instructions and behavior.