dev-machine-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes multiple runtime "run-block" install commands that fetch and execute remote scripts (for example: curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh | sh and curl -fsSL https://claude.ai/install.sh | bash), so these URLs would cause remote code to be run during skill execution if the user approves.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly requires admin/sudo and directs mutating system changes (package installs, chsh, rc-file overwrites, curl|sh, PATH rewrites and debloat/removals) which push the agent to change the machine state and perform privileged operations.