aws-iot-greengrass

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains setup instructions that clone and build external repositories at runtime—e.g., "https://github.com/aws-greengrass/aws-greengrass-lite.git"—which fetch remote code that is built/executed and is required for the Greengrass Lite setup, so this is a runtime external dependency that can execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly requires and recommends running Greengrass Nucleus with root privileges and using --privileged containers (and references container/systemd setups that need root), which directs the agent to perform privileged operations that can compromise the host state.