environment-setup-guide

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The guide includes commands that fetch and immediately execute remote install scripts at runtime (e.g., Homebrew: https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh; Node setup: https://deb.nodesource.com/setup_20.x; Chocolatey: https://community.chocolatey.org/install.ps1; Docker: https://get.docker.com), which causes remote code to be executed as part of the setup process.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs running multiple sudo commands (apt installs, running remote install scripts with sudo, sudo usermod -aG docker), and suggests inspecting/modifying system services (systemctl) and user/group settings, which push the agent to perform privileged changes to the host system.