portless-ops

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The PowerShell installer (scripts/install-portless.ps1) downloads and verifies a remote npm tarball at "https://registry.npmjs.org/portless/-/portless-$Version.tgz" and then runs npm install -g (which will fetch and execute package install-time code), so this URL is a runtime dependency that can lead to executing remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs users to perform privileged system changes (installing a global npm package, binding to port 443, adding a local CA to the system trust store, writing /etc/hosts, and installing OS startup tasks), which require elevated privileges or modify system files and thus push the agent toward altering the machine state.