rust-windows-setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most URLs point to rsproxy.cn, a third‑party mirror used here as the rustup/crates registry and update root (i.e., a source that can deliver executables and packages outside official rust-lang infrastructure), which is potentially risky if the mirror is untrusted or compromised; the static.rust-lang.org exe URL is official and not flagged.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The included PowerShell script and guidance set RUSTUP_DIST_SERVER / RUSTUP_UPDATE_ROOT and cargo registries to https://rsproxy.cn (and sparse+https://rsproxy.cn/index/ / https://rsproxy.cn/crates.io-index), which are used at runtime to download toolchains/crates that will execute code, so these external hosts directly affect runtime behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs changing system state (setting Windows env/Path) and explicitly directs running privileged installers (VS Build Tools require UAC/admin) and using "powershell -ExecutionPolicy Bypass" (bypassing a security mechanism), which pushes the agent to obtain elevated privileges and modify the host system.