agent-swarm

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The README explicitly instructs cloning and loading external subagents from https://github.com/lst97/claude-code-sub-agents.git (and configuring MCP servers that run npx to fetch remote MCP packages), which will fetch and execute external code that the agent loads at startup and can directly control prompts/behavior.