creating-sbx-kits

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs are suspicious because they point to placeholder/untrusted hosts and include a direct tarball download used in an install step (an active code load) and an arbitrary git URL (also an active code load) without an authoritative, pinned, or verified vendor source.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly describes install hooks that run as root (uid 0) and instructs authors to write files into system locations (e.g. /opt, /usr/local/bin) and create executable files via setup.files, which directs changes to the sandbox/machine filesystem and thus can modify system-level state.