jetson-video-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill’s installation scripts fetch and install remote packages at runtime (executing remote code), notably the PyCUDA sdist at https://files.pythonhosted.org/packages/75/93/36ffd54430924dcb03a88c97519d56589e573d0dcc999c77a4c4d8a90306/pycuda-2026.1.tar.gz and use external package indexes such as https://download.pytorch.org/whl/cu130 and APT origins like https://repo.download.nvidia.com/jetson/common which are required runtime dependencies that result in executing remote code on the target.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running installation plans that perform APT refresh/apply and run steps marked privilege: "root", and it relies on internal sudo escalation (plan_install.py owns sudo -n), which directs modifying the machine's privileged state.