cachyos-pacstrap-builder

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill pulls the pacstrap-builder layer by git reference at @github.com/overthinkos/overthink/candy/pacstrap-builder: during the build/runtime (it is "pulled by git reference"), which is a required dependency whose fetched content would supply and execute build code—i.e., remote code execution at runtime.