sesame-onboard

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime install commands that fetch-and-execute remote code (e.g., curl -fsSL https://getsesame.dev/install.sh | sh and downloading installers from https://awscli.amazonaws.com/AWSCLIV2.pkg / https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip), which are external runtime dependencies that will execute remote code on the host.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). This skill directs the agent to run system installers (curl | sh, macOS/Linux installers with sudo) and to execute deployment commands that change infrastructure (provision EC2/RDS and require broad IAM permissions), so it instructs actions that modify the host/environment and require elevated privileges.