packer-images

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Packer HCL declares a required plugin with source "github.com/hashicorp/amazon" which "packer init" will fetch at runtime and install/execute as plugin code, so this is a runtime external dependency that executes remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly includes privileged operations (multiple "sudo" commands), installs packages, modifies system files (e.g., /etc/nginx/nginx.conf), and enables system services via systemctl, all of which alter the host/image state and require elevated privileges.