scanning-quality

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly queries GitHub releases and installs the external tool "zizmor" at runtime via pipx/uvx (i.e. contacting github.com / api.github.com to fetch a release and install/execute it), which fetches and executes remote code used by the scan.