implementing-threat-modeling-with-mitre-attack

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Python snippet in SKILL.md performs a runtime download of ATT&CK STIX data from https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json and then parses that external JSON to build threat actor/technique profiles that directly control the agent's outputs, so this external URL is a required runtime dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs running adversary emulation (Atomic Red Team / Invoke-AtomicTest) that performs actions like creating scheduled tasks, writing registry run keys, and credential-dumping which modify the host system state and can compromise the machine.