devsecops-newservice

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly instructs runtime fetching/applying of external content (Argo CD sources and install.sh) — e.g., it uses the Git repo URL https://github.com/tanut-pen/dev-sec-ops.git (and external Helm chart repos like https://grafana.github.io/helm-charts) which will be fetched and rendered/applied at runtime, so remote content can execute code in the cluster.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). This skill explicitly instructs the agent to modify repository and cluster configuration (append argocd/app-list.yaml, add static ingress manifests, create install.sh that runs helm/kubectl, and manage secrets), which changes the state of the host/cluster and can alter system security/configuration, so it should be flagged.