voice-agent

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's start.sh explicitly runs "docker pull trevisanricardo/ai-voice-backend" and then "docker run ... trevisanricardo/ai-voice-backend", which at runtime fetches and executes a remote Docker image (docker.io/trevisanricardo/ai-voice-backend) that the client depends on, so this is a high-confidence execution-of-remote-code risk.