Emacs Ecosystem

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes bootstrap code that downloads and evaluates remote install code at runtime (https://raw.githubusercontent.com/radian-software/straight.el/develop/install.el) and examples that call treesit-install-language-grammar with GitHub language grammar URLs (e.g. https://github.com/tree-sitter/tree-sitter-python, https://github.com/tree-sitter/tree-sitter-javascript, https://github.com/tree-sitter/tree-sitter-typescript) which will fetch and install/compile external grammars — both clearly fetch and execute remote content at runtime.