dgx-spark-user-guide

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Several URLs point to on-prem/local mirror servers (10.111.x.x) hosting APT packages and LVFS firmware (and the docs explicitly show these mirrors configured as trusted or allowing untrusted firmware), which is a high-risk vector for distributing unverified/malicious executables or firmware in place of official sources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime installation/provisioning steps that download and then execute remote scripts/binaries (e.g., https://gitlab.com/fwupd/lvfs-website/raw/master/contrib/sync-pulp.py, https://raw.githubusercontent.com/apt-mirror/apt-mirror/master/apt-mirror, and http://ports.ubuntu.com/ubuntu-ports/dists/jammy/main/uefi/grub2-arm64/current/grubnetaa64.efi.signed), which are fetched at runtime and then run or used as executable boot code.