modeling-threats-with-opencti

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill performs a runtime git clone of remote code and then runs that compose stack (which fetches and executes containers), so the URL https://github.com/OpenCTI-Platform/docker.git is a required runtime dependency that can execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly tells the user to run "sudo sysctl -w vm.max_map_count=1048575", which requests elevated privileges to change a kernel sysctl and therefore instructs a privileged, state-changing operation on the host.