aem-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). 'npx -y @adobe/aem-cli up' runs the @adobe/aem-cli package fetched at runtime (see https://www.npmjs.com/package/@adobe/aem-cli), which downloads and executes remote code locally.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill is mainly local development docs, but it includes instructions that modify system trust (mkcert -install / installing corporate CA via NODE_EXTRA_CA_CERTS) and global npm installs which can change system state or require elevation, so it poses a moderate risk though it does not explicitly ask the agent to escalate to sudo, create users, or edit protected system config files.