vps-setup-hardening

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). Several installer scripts fetch repository definitions and GPG keys at runtime (for example https://pkgs.tailscale.com/stable/amazon-linux/2023/tailscale.repo, https://download.docker.com/linux/ubuntu/gpg, and https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key), which are required to install packages (i.e., fetch and execute remote code) during skill execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs the agent to stage and run profile scripts against remote servers, perform mutations, reboots, and session/SSH changes (actions that modify system state and may require sudo/elevated access), so it pushes the agent to change the machine state.