new-project-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill downloads a binary tarball from GitHub (https://github.com/rtk-ai/rtk/releases/latest/download/rtk-x86_64-unknown-linux-musl.tar.gz) during runtime execution, representing a high-tier weak/unknown operational dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill installs a binary into a system-wide directory (/usr/local/bin) which typically requires root/sudo privileges, and modifies global configuration files (~/.claude/settings.json).