image-assets

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). scripts/_env.py downloads and executes get-pip.py from https://bootstrap.pypa.io/get-pip.py at runtime (urllib.request.urlretrieve then subprocess.run to run the downloaded script), which fetches and runs remote code.