digital-ocean

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires the doctl CLI at runtime and its installation instructions explicitly download and install a remote binary from https://github.com/digitalocean/doctl/releases/download/v1.104.0/doctl-1.104.0-linux-amd64.tar.gz, which fetches and installs executable code that the skill then relies on.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill includes explicit sudo commands to install/move the doctl binary (modifying /usr/local/bin) and directs privileged SSH/root operations on provisioned droplets, so it instructs privileged/local system changes that could alter the host if executed by the agent.