coverage-debt-tracker

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow in references/ledger-rendering-and-ci.md pulls and runs external GitHub Actions at runtime (actions/checkout@v5, actions/download-artifact@v4, peter-evans/create-issue-from-file@v5), which fetch and execute remote code as part of the skill.