new-project-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill executes a curl command fetching an arbitrary, user-selected personal repository release (https://github.com/rtk-ai/rtk/releases/latest/download/rtk-x86_64-unknown-linux-musl.tar.gz) for installation and execution, constituting an unverifiable runtime external dependency with weak/unknown provenance at high tier.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill prompt instructs the agent to download and extract binaries directly into /usr/local/bin via curl and tar, which typically requires root/sudo privileges and modifies system-wide binary directories.