wk-cloudsmith

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Buildkite plugin git URL "ssh://git@github.com/$GITHUB_ORG/cloudsmith-auth-buildkite-plugin.git#v2.2.0" is fetched at pipeline/runtime and runs plugin code (exchanging OIDC tokens and injecting env vars), so it constitutes a runtime external dependency that executes remote code.