rch

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs explicitly instruct running a remote installer that is fetched-and-executed at runtime (e.g., curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh), which would execute remote code on workers and is presented as a required installation step for Rust toolchains.