multica-runtimes-and-repos

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes "multica repo checkout " (and the daemon /repo/checkout flow) to fetch git repositories at task runtime and the daemon then injects that repo content into the agent workdir and launches provider CLIs, so arbitrary remote repo URLs fetched at runtime can supply and execute code that controls agent behavior.