parallel-agents

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The prereq runs remote code at setup time via “curl -fsSL https://box.ascii.dev/install | sh”, which fetches and directly executes external code that the skill depends on.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs installing a remote CLI via curl|sh, logging in with an API key, running a setup.sh on a base VM, and forking/ssh-ing into many machines to run arbitrary scripts — actions that modify the host and provisioned machines (and could execute privileged or state-changing commands), so it pushes the agent to change system state.