docker-hub

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains installation commands that fetch and then execute remote installer tarballs from GitHub (e.g. https://github.com/goharbor/harbor/releases/download/v2.10.0/harbor-offline-installer-v2.10.0.tgz and https://github.com/goharbor/harbor/releases/download/v2.12.0/harbor-online-installer-v2.12.0.tgz), which download remote code and run ./install.sh, so they are runtime external dependencies that execute code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs modifying system-wide Docker daemon config (/etc/docker/daemon.json) and running registry/Harbor installers (edit harbor.yml, ./install.sh), actions that require root/sudo and change the machine's state.