cali-coding-go-standards

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository contains a curl command that fetches and pipes a remote shell script from https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh (seen in references/lint-config.md and injected into setup hooks in references/setup-hooks.sh), which would execute remote code when run as instructed by the skill (install/setup steps), yielding a direct remote-code-execution risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly requires the agent to "auto-create these hooks" and to run a setup script that registers global hooks and modifies user/project config (e.g., ~/.pi hooks, .air.toml), which directs the agent to change the user's machine state and global configuration even though it doesn't request sudo or user creation.