publish-orion-release

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow requires and verifies the GitHub release asset at https://github.com/nicolasakf/Orion-app/releases/download/v/orion-app-.tar.gz, which is fetched during publish/verification (curl, pip install, npx) and contains executable app bundle code that will be downloaded and run, so it is a runtime external dependency that can execute remote code.