process-compose-ops

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes install scripts and SKILL.md curl/Invoke-WebRequest lines that download and extract the release ZIP from "https://github.com/F1bonacc1/process-compose/releases/download/$VER" (and the same base with $Version), which fetches a remote binary that the scripts then extract/run—i.e., remote code is fetched and executed as part of install/runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly describes enabling a built-in MCP server that lets an AI agent list and directly restart/stop/start host processes (giving an agent control over system processes) and includes example instructions to register a Task Scheduler entry with elevated/run-level highest settings, which together push the agent toward modifying the machine's state.