gooserelayvpn-socks5-tunnel

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). The set mixes legitimate services (Google Apps Script, Chrome Web Store, api.ipify) with prebuilt executable archives hosted in GitHub releases from a small/unknown user (kianmhz) and instructions to download and run those binaries plus domain‑fronting/evasion techniques, which together create a notable risk of distributing or running untrusted executables.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill requires the client to poll publicly-deployable Google Apps Script web apps (script.google.com / exec URLs listed as script_keys in client_config.json and described in the "Deploy Google Apps Script" and "Multiple Deployments" sections), which are user-created public endpoints that the agent fetches and interprets for tunneling/health decisions, so untrusted third-party content can influence runtime behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs creating and editing a systemd service under /etc, running sudo systemctl commands, and opening firewall ports with sudo, which require elevated privileges and modify the machine's system state.