render-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documentation includes runtime/install-time commands that fetch and execute remote code (curl | sh to https://raw.githubusercontent.com/render-oss/cli/refs/heads/main/bin/install.sh, a direct CI download https://github.com/render-oss/cli/releases/download/v1.1.0/cli_1.1.0_linux_amd64.zip, and a git clone git@github.com:render-oss/cli.git followed by build), which are confirmed execution vectors.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes installation instructions that execute remote install scripts and explicitly use sudo to move a binary into /usr/local/bin (modifying system files), which requests elevated privileges and can change the host state.