setup-web-tests

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup script uses the GitHub API at https://api.github.com/repos/astral-sh/python-build-standalone/releases/latest to discover and curl-download a python-build-standalone release tarball which is extracted and whose python binary is executed at runtime, meaning remote code is fetched and run (https://github.com/astral-sh/python-build-standalone/releases).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). It explicitly instructs privileged operations—e.g., using sudo to append to /etc/hosts and to run apt-get install—which modify system files and require elevated privileges.