ue-graph-capture

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The AGENTS.md and agent-ruleset.json explicitly reference and require fetching the remote rule source "github:metyatech/agent-rules" (AGENTS.md shows "github:metyatech/agent-rules@HEAD/rules/domains/skill/repository.md"), which is fetched at runtime by the required compose-agentsmd flow and directly controls agent rules/instructions, so this is a high-confidence runtime external dependency.