vss-deploy-dense-captioning

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The deploy flow includes a runtime wget of a raw GitHub compose (https://raw.githubusercontent.com/NVIDIA-AI-Blueprints/video-search-and-summarization/${VSS_REF}/deploy/docker/services/rtvi/rtvi-vlm/rtvi-vlm-docker-compose.yml) which is then used by docker/docker-compose (docker pull/up) to launch containers — i.e., remote configuration is fetched at runtime and executed, so it directly enables execution of remote content.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs the agent to perform privileged host operations (use sudo for ownership fixes, run docker commands that imply elevated access, and explicitly suggests editing /etc/docker/daemon.json), which modify system files and require/assume root-level privileges and can change the machine state.