nvidia-sync

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Ubuntu installation snippet fetches a remote GPG key and registers an external APT repository at runtime (curl https://workbench.download.nvidia.com/stable/linux/gpgkey and deb https://workbench.download.nvidia.com/stable/linux/debian), which causes remote code/packages to be downloaded and executed via apt.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly includes tasks to inspect/validate/delete a netplan configuration (99-nvidia-sync-cluster.yaml) and to import SSH config entries, which involve modifying system network and SSH configuration files that typically require sudo or can alter the machine state.