coverage-diff-reporter

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes third-party GitHub Actions that are fetched and executed at runtime—dawidd6/action-download-artifact@v3 (used to restore the baseline in Pattern A) and marocchino/sticky-pull-request-comment@v2 (used to post/update the PR comment)—which are remote code executed as part of the skill run.