quarto-netlify

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The netlify.toml build command performs a runtime curl of https://quarto.org/download/latest/quarto-linux-amd64.deb, extracts it, adds the binaries to PATH, and then runs those remote binaries (quarto render), so it fetches and executes remote code as a required runtime dependency.