post-deploy
Warn
Audited by Snyk on Mar 2, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill requires running compose-agentsmd at session start which pulls the rule source from github:metyatech/agent-rules@HEAD, and those fetched rules (AGENTS.md) directly control agent instructions at runtime.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to rebuild globally linked packages and restart/manage running services (e.g., PM2/systemctl), and to inspect scheduled tasks and global npm links—actions that change system state and can require elevated privileges, so it should be flagged.
Audit Metadata