join-tailnet

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The official api.tailscale.com endpoints are legitimate, but the api-tailscale.int.exe.xyz host is a non-official, internal-looking domain that impersonates the Tailscale API (including a malformed variant with a trailing brace) and therefore looks suspicious and worthy of caution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs attaching the tailscale-api to a VM, SSHing in to start/enable the tailscaled service and mint auth keys — all actions that modify system state and grant privileged/network authority on the machine.