ucloud-sandbox-site

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill downloads and executes remote installer scripts at runtime (curl ... https://raw.githubusercontent.com/ucloud/ucloud-sandbox-cli/main/install.sh then sh, and Invoke-WebRequest ... https://raw.githubusercontent.com/ucloud/ucloud-sandbox-cli/main/install.ps1 then &), which fetches and runs external code required for the CLI installation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs using passwordless sudo (sudo -n) to bind privileged ports, install system packages, run systemctl/service commands, and write to system directories (e.g., /etc, /usr), which pushes the agent to perform privileged, state-changing operations on the machine/sandbox.