runtime-chromebook

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs remote installer scripts at runtime via curl -fsSL https://downloads.ortussolutions.com/boxlang/install-boxlang.sh | bash and curl -fsSL https://downloads.ortussolutions.com/bvm/install.sh | bash, which executes fetched remote code and is relied on for installing BoxLang/BVM, so this is a high-confidence runtime remote-code risk.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs the agent/user to run multiple sudo commands and modify system-wide files and directories (e.g., /opt/java, /usr/share/keyrings, /etc/apt/sources.list.d) and to execute remote install scripts (curl | bash), which directly change the machine state and require elevated privileges.