plankton-code-quality

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Quick Start instructs cloning https://github.com/alexfazio/plankton.git whose fetched hook scripts are executed by Claude Code at runtime (PostToolUse hooks run linters and spawn subprocesses), so remote code from that URL directly controls agent behavior and executes code.