cofounder-ssh-key-rotation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The caller workflow references and runs the reusable workflow locaweb/locaweb-cloud-provision/.github/workflows/rotate-ssh-key.yml@v1, which GitHub Actions will fetch and execute at runtime—so external repository code controls the rotation execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to delete and recreate local SSH keys, change file permissions, commit and push workflows, update secrets, and run operations that stop VMs and overwrite remote authorized_keys (permanently revoking access), so it directly modifies system state and access controls and is high-risk.