card-widget

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). scripts/install_firmware.py downloads a user-supplied --url via urllib.request.urlretrieve and then flashes the downloaded binary with esptool.py (allowing arbitrary remote firmware to be executed on the device), so there is a runtime fetch that can execute remote code.