skill-name

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The iac-scan CI step runs at workflow runtime and executes a remote install script via "curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash", which fetches and executes remote code as a required step to install/run tfsec.