awscli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). I flagged the AWS CLI installer URL (https://awscli.amazonaws.com/AWSCLIV2.pkg) because the Quick Start instructs fetching that package with curl and then running the system installer (sudo installer -pkg ...), which downloads and executes remote code as a required setup step.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running "sudo installer -pkg ... -target /", which requests elevated privileges and modifies system files (i.e., asks the agent to obtain sudo and change machine state).