koda-vscode-helper

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires fetching remote URLs at runtime (see line 24) and uses official docs/API endpoints such as https://api.github.com/repos/microsoft/vscode/releases/latest which can be fetched and injected into the agent's responses, so these external URLs directly influence prompts at runtime.