cursor-sdk

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill shows cloud agents clone repos at runtime and explicitly notes cloud agents execute repository hooks (e.g., .cursor/hooks.json), so the example repo URL "https://github.com/your-org/your-repo" (used as repos[].url) represents a runtime-fetched external dependency that can cause remote code/hooks in the repo to be executed.