resonate-server-deployment

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include direct downloads of an executable binary from a GitHub release and a shell script from an untrusted/placeholder domain, both of which are high-risk vectors for distributing malware if the sources are not verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime shell commands that download and execute remote code: curl -L -o deploy-resonate.sh https://example.com/deploy-resonate.sh followed by sudo ./deploy-resonate.sh (SKILL.md:23-25) and curl -L -o jwt https://github.com/mike-engel/jwt-cli/releases/latest/download/jwt-linux which is made executable and installed (SKILL.md:162-165), meaning external content is fetched and executed at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly requires root/sudo, instructs running sudoed install scripts, moving binaries to /usr/local/bin, copying keys into /etc/resonate, and creating/modifying systemd service files under /etc/systemd — all actions that change the host system state and need elevated privileges.