sast-runner

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The script passes semgrep a --config value drawn from CONFIGS (e.g. "p/security-audit", "p/owasp-top-ten", "p/cwe-top-25"), and Semgrep interprets "p/..." as registry rulepacks fetched at runtime, so remote rule content can be loaded during execution and directly control scanning behavior.