latitude-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install instructions explicitly download and then run a remote CLI binary using curl from the GitHub releases API and matching release asset URLs (e.g. https://api.github.com/repos/latitude-dev/latitude-llm/releases?per_page=100 and the extracted release asset URL like https://.../latitude-macos-arm64.tar.gz), which fetches remote executable code that the guide then instructs you to extract and run.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The prompt is largely benign installation guidance, but it explicitly includes a macOS Gatekeeper bypass (xattr -d com.apple.quarantine) and permits using sudo to place the binary on PATH, both of which are security-sensitive state changes.