asc-appstore-release

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The workflow instructions fetch the asc-cli release binary from https://github.com/tddworks/asc-cli/releases/download/v${VERSION}/asc_${VERSION}_macOS_${ARCH}, which is a third-party unofficial GitHub repository supplying executable command-line tools governing agent behavior.