video-analyze

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's bootstrap and setup commands invoke pip installs that fetch and execute remote packages at runtime (e.g., "uv pip install -i https://pypi.tuna.tsinghua.edu.cn/simple torch" and "--index-url https://download.pytorch.org/whl/cpu"), and whisper.load_model will auto-download the Whisper model from HuggingFace, so these URLs are used at runtime to fetch and execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). 本技能明确要求在主机上执行系统级安装并含有 sudo 指令（例如 "sudo apt install -y pipx"、"sudo apt install -y ffmpeg"），且提到“可直接用无密码 sudo 安装”，即引导使用提升权限修改系统状态，存在高风险。