crawlkit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow sets GOPROXY=https://proxy.golang.org and runs go list/go test against the module path github.com/vincentkoc/crawlkit, which will fetch remote Go module source from the proxy/module host and can result in executing that remote code at runtime (e.g., via go test), so these URLs are runtime dependencies that can execute remote code.