jeo

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The master installer (scripts/install.sh) executes a remote installer via "curl -fsSL https://plannotator.ai/install.sh | bash", which fetches and runs remote code at install time and installs the plannotator CLI that the skill uses as the mandatory PLAN gate (i.e., it directly enables external code that controls prompt/approval behavior).