qveris-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README contains a one-liner that directly fetches and executes remote code (curl -fsSL https://qveris.ai/cli/install | bash) and also documents runtime package fetches (npx @qverisai/cli / npm install -g @qverisai/cli), which clearly download and execute external code as part of setup/use.