agencyzoom

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs the agent to run npx @useclawlink/cli commands (which fetch and execute the remote npm package at runtime — https://www.npmjs.com/package/@useclawlink/cli), so it depends on executing external code fetched during runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to run CLI commands that mint and store credentials locally (e.g., ~/.clawlink/credentials.json) and to connect external services, which modifies the host state and grants the agent delegated access to act on remote accounts.