multica-projects-and-resources

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly accepts and stores GitHub repository URLs (e.g., "") as durable github_repo.resource_ref.url resources that the daemon will checkout and inject repository content into task briefs, meaning remote repo content can be fetched at runtime and directly influence prompts or execute code.