migration-ascend-torchnpu-skills

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes explicit runtime fetch-and-install commands that download and execute remote packages/repositories (e.g., pip/wget of torch and torch_npu wheels from https://download.pytorch.org/whl/... and https://gitcode.com/Ascend/pytorch/releases/.../torch_npu-2.6.0.post5-..., and git clone https://gitcode.com/Ascend/pytorch.git or git clone https://github.com/opencv/opencv.git), so these URLs are used at runtime to fetch and run remote code which the skill depends on.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). Flagged because the skill mandates environment setup that includes installing Ascend drivers/CANN, configuring system-level packages and environment variables and providing exact installation commands—actions that typically require sudo/root and modify system files, thus pushing the agent to change the machine state.