changelog-automation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The included GitHub Actions workflow and install/run commands reference and will fetch/execute remote code at runtime (e.g., uses: actions/checkout@v4, uses: softprops/action-gh-release@v1, run: npx semantic-release, pip install commitizen), so the skill depends on external packages/actions that execute remote code in CI.