sentry-otel-exporter-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill performs runtime fetches of remote content — including the GitHub API to discover releases (https://api.github.com/repos/open-telemetry/opentelemetry-collector-releases/releases/latest), downloading and extracting a collector binary from GitHub releases (https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v<numeric_version>/otelcol-contrib_<numeric_version>.tar.gz), and retrieving raw configuration templates from raw.githubusercontent.com (https://raw.githubusercontent.com/open-telemetry/opentelemetry-collector-contrib/main/exporter/sentryexporter/docs/example-config.yaml and https://raw.githubusercontent.com/open-telemetry/opentelemetry-collector-contrib/main/exporter/sentryexporter/docs/spec.md), which can execute remote code or directly control the configuration the agent will write and run.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to perform system-level actions (download and extract binaries, chmod and run a collector, edit/create config and .env files, and run Docker containers) and even says "Perform these steps for the user—do not just show them the commands," which pushes the agent to modify the host machine's state.