runtime-go-toolchain

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly sets GOPROXY=https://goproxy.cn at runtime, which will direct Go module fetching through that remote proxy and thus can cause remote code (modules) to be retrieved and executed during builds/tests.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt directs the agent to perform system-level provisioning (inspecting /etc/os-release, running apt-get update/install and altering PATH or creating Docker environments), which modifies machine state and may require elevated (sudo) privileges.