Reel

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CI workflow includes a runtime curl that fetches and extracts the VHS binary from https://github.com/charmbracelet/vhs/releases/download/v${VHS_VERSION}/vhs_${VHS_VERSION}_linux_amd64.tar.gz which downloads and installs remote executable code (a required dependency) that will be run, so this is a runtime remote-code dependency.