hashcards-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup explicitly downloads and executes remote code at runtime via "curl https://sh.rustup.rs | sh" (installs Rust) and clones+builds the repository from "https://github.com/eudoxia0/hashcards.git", so both URLs are runtime-fetched required dependencies that result in executing external code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to run system-level package installs (apt-get), install dev libraries, write files in system paths, and register a persistent service (including a /root path), all of which modify machine state and require elevated privileges and expose an unauthenticated web service.