go-release

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running go run on remote modules (golang.org/x/exp/cmd/gorelease@latest, golang.org/x/exp/cmd/apidiff@latest, golang.org/x/vuln/cmd/govulncheck@latest), which fetches and executes remote Go code at runtime and is relied on as a verification dependency.