inbox-install-gh-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Linux install command uses wget to fetch https://cli.github.com/packages/githubcli-archive-keyring.gpg and adds the apt repository at https://cli.github.com/packages, which results in downloading and executing remote packages during setup (apt install gh), so these URLs are runtime dependencies that execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The Linux install command instructs using sudo to create and modify /etc/apt keyrings and sources (system-wide files) and to run apt update/install, which modifies protected system state and requires elevated privileges.