process-compose-ops

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The included install script (scripts/install-process-compose.ps1) fetches and extracts the Process Compose release zip from GitHub Releases (e.g. https://github.com/F1bonacc1/process-compose/releases/download/v1.110.0/process-compose_windows_amd64.zip) at runtime and then runs the unpacked binary, meaning remote content is fetched and executed as part of the skill's installation/runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt includes commands to register a persistent Windows Scheduled Task with RunLevel Highest and uses "-ExecutionPolicy Bypass" (explicitly bypassing PowerShell execution policy), and provides installation/boot-persistence steps that modify system state — i.e., it instructs bypassing security controls and changing system configuration.