living-docs

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CI/Phase-1 instructions explicitly fetch and run remote scripts (e.g., adding the git submodule https://github.com/your-org/living-docs.git and running .living-docs/scripts/*.sh, and Phase-2 cloning via URLs like https://x-access-token:...@github.com/your-org/.git), which means external repository content is fetched at runtime and executed as part of the workflow.