deps-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly performs runtime fetch-and-execute operations (notably the curl | sh installer at https://astral.sh/uv/install.sh) and also runs git clone / pip install against remote repos (e.g. git+https://github.com/browser-use/video-use, https://github.com/HKUDS/VideoAgent, https://github.com/ggerganov/whisper.cpp) which download and execute remote code as part of setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs running privileged system changes (e.g., "sudo apt install -y libimage-exiftool-perl mediainfo") and other system-wide installs (npm -g, flatpak), which require elevated privileges and modify the host system state.