ffmpeg-cicd-runners

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains runtime commands that download and install remote binaries or run external actions/containers—e.g. wget https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-n7.1-latest-linux64-gpl-7.1.tar.xz, Invoke-WebRequest "https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-n7.1-latest-win64-gpl-7.1.zip", and the GitHub Action reference uses: FedericoCarboni/setup-ffmpeg@v3 (and docker image jrottenberg/ffmpeg:7.1-ubuntu2404)—all of which fetch and execute external code at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt repeatedly instructs running privileged system commands (eg. sudo apt-get install, sudo cp into /usr/local/bin) and altering system paths/binaries in CI runners, which direct the agent to obtain elevated privileges and modify machine state.