ceos-scorecard

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs a runtime git fetch ("git -C <ceos_root> pull --ff-only --quiet") to update the CEOS repository (origin remote), and the fetched files (data/scorecard/.md and templates/.md) directly control the agent's prompts/output, so this is a runtime external dependency that can change agent behavior.