tao-setup-nvidia-gpu-host

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install path of the script (invoked with --install) uses curl to fetch and install remote packages/repo files at runtime (e.g., https://developer.download.nvidia.com/compute/cuda/repos/...cuda-keyring_1.1-1_all.deb, https://nvidia.github.io/libnvidia-container/... (gpgkey and nvidia-container-toolkit.list), and https://download.docker.com/.../docker-ce.repo), and those fetched artifacts are installed/used (dpkg -i, written to /etc/yum.repos.d/, apt/yum/zypper installs), which means remote content is fetched at runtime and can execute code on the host.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing system packages, adding repositories, modifying system services (systemctl), adding the invoking user to the docker group, and running modprobe—actions that change host state and require elevated/sudo privileges or create user/group modifications.