vhs-demo

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Dockerfile fetches and runs a remote base image (FROM ghcr.io/charmbracelet/vhs) during build/run and also contains a RUN that executes remote install code via curl | bash from https://bun.sh/install, both of which fetch and execute remote code at runtime.