alibabacloud-ecs-patch-management

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Pre-check explicitly instructs running a remote installer with command curl -fsSL https://aliyuncli.alicdn.com/setup.sh | bash, which fetches and immediately executes remote code to install a required dependency (Aliyun CLI), so this URL is a runtime external dependency that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to perform destructive, state-changing operations (start-installing OS patches, create snapshots, and reboot ECS instances) and even suggests installing the CLI via a curl|bash installer and toggling local AI-mode—actions that modify system state and can cause downtime—so it must be flagged.