bootstrap-zig-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Mixed list includes direct-install endpoints and raw installer scripts (GitHub releases/raw.githubusercontent.com and a curl|bash URL on a personal domain) which are commonly used to distribute binaries/scripts from untrusted owners and are high-risk; localhost and a malformed URL are benign but don't mitigate the presence of those risky links.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains an explicit runtime command that downloads and pipes a remote installer into a shell—"curl -fsSL https://christianhelle.com/openapi2zig/install | INSTALL_DIR="$HOME/.local/bin" bash"—which would execute remote code when the OpenAPI client generation path is used.