cmd-makefile
Warn
Audited by Snyk on Aug 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The Makefile template includes an install-cli target that at runtime curls https://api.github.com/repos/$(GITHUB_REPO)/releases/latest to discover a release and then downloads a binary from https://github.com/$(GITHUB_REPO)/releases/download/$$RELEASE/cli-$(OS)-$(ARCH) into ~/.local/bin and makes it executable, i.e., it fetches and installs remote executable code at runtime.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata