write

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's Release Notes pre‑flight explicitly instructs fetching a target repo's release text at runtime via "gh release view --json body -R /" (i.e., fetching GitHub release content such as from https://api.github.com/repos///releases/latest) and then using that content to control style and prompts, so it meets the criteria for a runtime external dependency that directly controls agent output.