svg-portrait-mode

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The portrait_mode skill calls _ensure_models() which at runtime downloads MediaPipe model binaries from https://storage.googleapis.com/mediapipe-models/face_detector/blaze_face_short_range/float16/latest/blaze_face_short_range.tflite and https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/latest/face_landmarker.task via urllib.request and those model files are subsequently loaded/executed by MediaPipe, constituting runtime fetching of remote binaries.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs running system-level package commands (pip with --break-system-packages and apt-get install) which modify system packages/files and can require or imply elevated privileges, so it risks changing the machine state.