delegate-agent

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The spawn script calls the GitHub API (e.g. https://api.github.com/repos/${GITHUB_OWNER}/${GITHUB_REPO}) at runtime to create branches and trigger GitHub Actions, and those repository workflows are remote code that will be executed to run sub-agents — a required external dependency that controls execution.