tao-setup-nvidia-gpu-host

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install script (scripts/setup-nvidia-gpu-host.sh) performs runtime curl/dpkg pulls and repo downloads that fetch and install remote packages — e.g. https://developer.download.nvidia.com/compute/cuda/repos/.../cuda-keyring_1.1-1_all.deb, https://developer.download.nvidia.com/compute/cuda/repos/.../cuda-.repo, https://nvidia.github.io/libnvidia-container/gpgkey and https://nvidia.github.io/libnvidia-container/stable/... (nvidia-container-toolkit.list / .repo), and the Docker repo URLs at https://download.docker.com/... — these URLs are fetched and executed/installed during runtime, so they are runtime external dependencies.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing system packages, adding repository files, modifying system configuration (adding the invoking user to the docker group), restarting services, and running modprobe — all actions that require sudo and change the host system state (including guidance for non‑interactive auto‑confirmation), so it clearly pushes the agent to modify the machine.