gomtm-installer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The code generates and uses GitHub release download URLs (e.g. https://github.com/codeh007/mtmskills/releases/download//mtminstaller--) at runtime — the bootstrap script and release/install commands download remote artifacts and the bootstrap script execs the downloaded binary, so remote content is fetched and executed.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill defines and recommends an online installer (curl|bash) and a Go CLI whose responsibilities include installing agent-tools, VNC/browser components and performing remote bootstrap — all actions that imply modifying the host system and likely requiring elevated privileges, so it pushes behavior that can change machine state.