gogcli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installation steps instruct cloning and building remote code (git clone https://github.com/steipete/gogcli.git followed by make), which fetches and then executes external code that the skill relies on.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The prompt explicitly includes "sudo make install" to install the tool globally, which requests elevated privileges and modifies system-wide files, thereby pushing the agent to change the machine's state.