cloudnative-pg

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The cloudnative-pg GitHub Pages site and repo appear legitimate, but the docs instruct piping a raw install-cnpg-plugin.sh from GitHub into sudo sh (a high-risk practice because a remote .sh executed as root can deliver malware if the repo or supply chain is compromised), and the minio.storage.svc:9000 endpoint is an internal MinIO service (not a public trusted CDN) that—especially when used with default credentials—can host arbitrary binaries; therefore treat these URLs as potentially risky and inspect the script and MinIO contents/credentials before running or downloading.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime command that fetches and executes remote code — curl -sSfL https://github.com/cloudnative-pg/cloudnative-pg/raw/main/hack/install-cnpg-plugin.sh | sudo sh -s -- -b /usr/local/bin — and also relies on Helm chart content from https://cloudnative-pg.github.io/charts during installation, so external content is fetched and executed at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt includes a command that pipes a downloaded script to "sudo sh" to install a binary into /usr/local/bin, explicitly asking for elevated privileges and modifying system files on the host.