skill-installer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installer scripts fetch and/or clone GitHub content at runtime (e.g. https://api.github.com/repos/{owner}/contents/{path}?ref={ref}, https://codeload.github.com/{owner}/{repo}/zip/{ref}, and cloning from https://github.com/{owner}/{repo}.git or git@github.com:{owner}/{repo}.git), and the fetched repo directories must contain SKILL.md (agent skill instructions), so remote content downloaded during runtime can directly control agent prompts or introduce executable code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly instructs the agent to "request escalation" when running networked install scripts and describes modifying $CODEX_HOME/skills (and optionally overwriting preinstalled system skills), which asks for elevated privileges and modifies the machine's state.