proto-codegen

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime commands fetch and use remote repository/module content — e.g., "temporalio/api" (used to generate TypeScript from protos) and "go.temporal.io/api" (fetched via go get and built) — which downloads and executes remote code during generation/sync, so these external resources directly affect runtime behavior.