phaser-runtime-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The script will at runtime load the local scaffold HTML which (per the README) commonly pulls Phaser from a CDN (e.g. https://cdn.jsdelivr.net), and the optional --install flow runs pip and playwright installers that fetch and execute remote packages/binaries from PyPI (https://pypi.org) and the Playwright browser CDN (e.g. https://playwright.azureedge.net), so external content is fetched during runtime and can execute code affecting behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to run installers that modify the system (pip, python -m playwright install chromium, playwright install-deps) and even documents actions that require sudo and a possible sandbox bypass (--no-sandbox), so it pushes changes to machine state and suggests bypassing security mechanisms.