homebrew-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill runs a runtime command that fetches and executes remote code via curl into bash: "https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh", which directly executes external script during the install step.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs running the Homebrew installer (which asks for the admin password), modifies user/system configuration (writes to ~/.zprofile and Homebrew prefixes), and runs brew bundle operations that can install, upgrade, or uninstall system-level software—actions that change the machine state and request elevated privileges.