chaos-mesh

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The skill instructs users to curl and pipe https://mirrors.chaos-mesh.org/v2.6.3/install.sh to bash — a direct remote shell script execution is a high-risk distribution pattern even if hosted on an apparently official mirror; the other URLs are local endpoints or an official Helm/chart host.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains a runtime "curl -sSL https://mirrors.chaos-mesh.org/v2.6.3/install.sh | bash" command which fetches and immediately executes remote code from https://mirrors.chaos-mesh.org/v2.6.3/install.sh.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs installing and running Chaos Mesh (including piping a remote install script to bash) and applying Kubernetes CRDs that perform destructive actions (pod-kill, network latency, CPU/IO stress, and remote physical-machine stress), which actively modify cluster/host state and can disrupt or compromise the machine the agent runs on.