public-web-deploy

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs include direct links to an archive (backup.zip) and sensitive files (.env, .git/config), plus an unencrypted HTTP endpoint and a dev server port (127.0.0.1:8000) — all are dangerous if publicly reachable and commonly used to leak secrets or distribute malicious payloads.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs editing system service/config files (nginx, /etc/nginx/nginx.conf), installing packages (apt-get install fail2ban), running and reloading system services (systemctl, certbot --nginx), and changing firewall (ufw) — all operations that modify the host state and require elevated/sudo privileges.