ruflo-doctor

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx @claude-flow/cli@latest at runtime, which fetches and executes remote npm package code (npx @claude-flow/cli@latest), so it executes remote code and is a required runtime dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly directs the agent to run npx commands that perform auto-repairs—force-initialize memory, start daemons, and reset configuration—which modify the machine's state and services (even if sudo isn't mentioned), so it poses a substantial risk of altering or compromising the host environment.