safe-settings
Warn
Audited by Snyk on Jul 18, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). This skill explicitly clones and/or checks out and runs code from the remote repository https://github.com/github/safe-settings (e.g., "git clone https://github.com/github/safe-settings" and the Actions workflow that checks out github/safe-settings and runs npm install / npm run), so remote content is fetched at runtime and executed as a required dependency.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata