depscan

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes explicit install/run commands that fetch and execute remote code at runtime (e.g., docker pull/run ghcr.io/owasp-dep-scan/dep-scan:latest and git clone https://github.com/owasp-dep-scan/dep-scan.git followed by pip install .), so the external URLs would execute required remote code for the skill.