nomad

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The installation instructions fetch resources from HashiCorp's APT endpoint (https://apt.releases.hashicorp.com/gpg and https://apt.releases.hashicorp.com) via wget/apt which will download and install remote packages (executing remote code), so this is a runtime/setup external dependency used to obtain and run code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running sudo commands that modify system keyrings and apt sources and install packages (lines 9-11), and includes a job config that mounts the host root into a container (lines 216-219), both of which require/lead to privileged changes to the machine state.