lazyweb-apply-design-best-practices

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The bulk of the URLs are raw GitHub SKILL.md files (low-risk text), but the list includes a direct third‑party install script (https://www.lazyweb.com/install.sh) that the skill instructs users to curl|bash — a high-risk pattern that can deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and read external SKILL.md instruction files at runtime (e.g. https://raw.githubusercontent.com/emilkowalski/skill/main/skills/emil-design-eng/SKILL.md), and also recommends running a remote install script via curl -fsSL https://www.lazyweb.com/install.sh | bash, so these URLs are runtime-fetched content that directly control prompts or execute code.