modeling-threats-with-opencti

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The deployment instructions explicitly run a git clone of the OpenCTI Docker repo (https://github.com/OpenCTI-Platform/docker.git) and then docker compose up, which fetches and executes remote container images/startup code at runtime, so this URL is a required external dependency that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs running privileged system commands (sudo sysctl -w vm.max_map_count=...) and starting system-level services/containers (docker compose up -d), which modify kernel/settings and require elevated privileges, so it pushes the agent to change the host state.