volcengine-iac

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs terraform init which explicitly downloads provider binaries from registry.terraform.io at runtime (mentioned as "Provider download ... goes through registry.terraform.io"), and those provider plugins are remote executables fetched and run locally, making registry.terraform.io a runtime external dependency that executes code.