customer-card-render

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The uv.lock file specifies exact URLs and SHA-256 hashes for PyPI packages (such as atheris and coverage) that are downloaded and installed during dependency synchronization, constituting a strong official/reputable third-party operational dependency fetch.