Emacs Ecosystem

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes an explicit straight.el bootstrap that uses url-retrieve-synchronously to fetch and eval remote code from https://raw.githubusercontent.com/radian-software/straight.el/develop/install.el (and also instructs runtime installation of tree-sitter grammars from GitHub URLs such as https://github.com/tree-sitter/tree-sitter-python, https://github.com/tree-sitter/tree-sitter-javascript, and https://github.com/tree-sitter/tree-sitter-typescript), which are fetched at runtime and can result in executing remote code.