oh-precommit-codecheck

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The setup.sh downloads and installs runtime tools from https://codeheck-chajian-bj4-obs.obs.cn-north-4.myhuaweicloud.com/tool-engines/Linux/codecheck-ide-engine.zip and https://codeheck-chajian-bj4-obs.obs.cn-north-4.myhuaweicloud.com/tool-engines/lsp-server/Linux/CodeCheckRT.zip during skill execution, and the unpacked codecheck-ide-engine.jar is later executed (java -jar), so remote code is fetched at runtime and executed as a required dependency.