test-release-canary

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow fetches and executes an external installer script at raw.githubusercontent.com/NVIDIA/OpenShell/${head_sha}/install.sh (referenced as the install.sh pulled into the canary and invoked via curl … | sh), which is a runtime-fetched remote script that directly executes code.