hsb-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly clones/refreshes the external GitHub repo at runtime (default HSB_REPO=https://github.com/nvidia-holoscan/holoscan-sensor-bridge.git) and then reads its docs and runs build/run scripts from that repo, so fetched content is used to drive agent prompts/decisions and to execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged commands (uses REMOTE_SUDO/"sudo", asks the user if they accept sudo for network/Docker setup), performs remote system modifications (install/fix prerequisites, build/run containers, adjust network/docker settings, persist environment variables, and may flash FPGA), so it directs actions that change the machine state and require elevated privileges.