alloy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime imports that fetch and load remote Alloy configuration/modules (e.g., import.git "https://github.com/grafana/alloy-modules", import.http "https://config-server/alloy/shared.alloy", and remotecfg "https://fleet-management.grafana.net"), which would inject external configuration/modules at runtime and therefore directly control the agent's behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt includes explicit instructions to run privileged installation (sudo apt install alloy) and references system-level config paths (/etc/alloy/config.alloy) and service flags, which require elevated privileges and can modify machine state.