ditto
Warn
Audited by Snyk on Jul 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The bootstrap script (scripts/bootstrap.py) downloads required runtime files from raw.githubusercontent.com using the URL template "https://raw.githubusercontent.com/ohad6k/ditto/{}/{}".format(metadata["ref"], name), fetching ditto.py (executable code) and MINING_PROMPT.md (prompt text) at runtime which directly control execution and agent prompts.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata