debug

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The runtime bootstrap (references/support/runtime-bootstrap.mjs) fetches the manifest from https://github.com/time-attack/gstack/releases/download/${BOOTSTRAP_RELEASE_TAG}/gstack-runtime-manifest.json at runtime and then downloads and installs release artifacts (which may execute installer code), so this URL is used to fetch remote code that can run during skill setup.