ci-cd-security

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow includes pinned GitHub Actions that are fetched and executed at runtime (for example https://github.com/step-security/harden-runner, as well as actions/checkout and actions/setup-node), so external repository code is required and will execute during skill runtime.