lazyweb-update

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set includes a high-risk curl | bash installer (https://www.lazyweb.com/install.sh) which pipes a remote shell script to the shell — a common malware vector; the GitHub/raw.githubusercontent URLs are lower-risk but still depend on trusting that repository.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime bootstrap commands that clone/fetch and then execute remote code from https://github.com/aboul3ata/lazyweb-skill (via git clone/reset then running setup) and also documents piping https://www.lazyweb.com/install.sh to bash, which clearly fetches and executes external code at runtime.