dbs-update

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs the command "npx -y skills add dontbesilent2025/dbskill -g --all" (SKILL.md:17) which at runtime fetches and installs remote Skill code (dontbesilent2025/dbskill) that will execute in the agent environment.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to execute a global npx install (npx -y ... -g) and to run the update immediately without further confirmation, which modifies the host system state and can require elevated privileges.