wsl-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation instructions instruct users to fetch-and-execute remote scripts at runtime (e.g., sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)", sh -c "$(curl -fsSL https://raw.githubusercontent.com/Linuxbrew/install/master/install.sh)", and curl https://mise.run | sh), which clearly execute remote code and are presented as required setup steps.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). Yes — the skill explicitly instructs the agent to perform system-level actions (wsl --install, --unregister, --import, editing /etc/wsl.conf and .wslconfig, enabling systemd) that modify system files, change distro state, and require elevated privileges, so it can alter or delete the machine’s state.