setup-gbrain

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime curl/API calls to Supabase (e.g., https://api.supabase.com/v1/projects) and also verifies/registers remote MCP endpoints (user-supplied MCP URL) during execution — these runtime requests fetch JSON that controls prompts/flow and perform actions (create/delete projects), so they are required external dependencies that can directly control the agent's behavior and execute remote operations.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs the agent to perform many state-changing and potentially destructive operations (git rm/commit, modifying repo files and .gitignore, installing CLIs, writing configs in the home dir, touching/removing vendored directories, registering credentials/tokens, creating/deleting Supabase projects and performing migrations), so it clearly modifies local and remote machine state even though it doesn't request sudo.