perf-setup
Warn
Audited by Snyk on Jun 22, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). This skill's runtime installer will run curl to download and extract the Google Cloud SDK installer (e.g. https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-darwin-$(uname -m).tar.gz and the linux equivalent) and then execute the fetched install.sh, which fetches and runs remote code required for the skill.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill autonomously runs system package installers (including explicit "sudo apt install python3"/"sudo yum install python3"), installs and modifies system-level tools (gcloud components), and writes files—actions that require elevated privileges and can change the machine state without explicit consent.
Issues (2)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
W013
MEDIUMAttempt to modify system services in skill instructions.
Audit Metadata