netlify-deploy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill invokes the Netlify CLI at runtime via commands like "npx netlify" (a required dependency that will fetch and execute remote code), and the repository for that CLI is referenced in the skill (https://github.com/netlify/cli), so remote code is executed during runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill primarily runs project-level CLI commands (npx, npm, git, creating netlify.toml) which are benign, but it explicitly instructs rerunning with escalated sandbox permissions (sandbox_permissions=require_escalated) to bypass sandboxed network restrictions, which is a security escalation and thus raises moderate risk.