implementing-code-signing-for-artifacts

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions referenced in the workflow (e.g., sigstore/cosign-installer@v3 and softprops/action-gh-release@v2 — https://github.com/sigstore/cosign-installer, https://github.com/softprops/action-gh-release) are fetched and executed at CI runtime, so they are external dependencies that execute remote code required by the skill.