maestro-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install.sh executed at runtime downloads and unzips an executable from https://github.com/mobile-dev-inc/Maestro/releases/download/cli-2.5.1/maestro.zip which is installed into /opt/maestro and then executed (via the maestro launcher), so a required runtime dependency fetches and supplies remote executable code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt instructs installing system packages and placing binaries into system locations (e.g., /usr/local/bin) and uses a curl|bash installer, which implies modifying system files and requiring elevated privileges, so it could change the host state and be abused.