lazyweb-growth-backlog

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is a direct link to a remote shell script (install.sh) on an untrusted domain paired with an instruction to pipe it to bash— a high-risk, common malware distribution pattern.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The document instructs running a remote shell script piped from curl and to silently open returned URLs — strong indicators of supply-chain / remote-code-execution and covert communication patterns that can be abused as a backdoor.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill tells operators to run "curl -fsSL https://www.lazyweb.com/install.sh | bash", which fetches and executes remote code at runtime (https://www.lazyweb.com/install.sh), creating a high-risk external dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). It instructs running a remote installer via "curl -fsSL https://www.lazyweb.com/install.sh | bash", which executes arbitrary code on the host and can modify system files or require elevated privileges.