airtable-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most entries are legitimate npm registry and GitHub/Airtable URLs (low risk), but the list also includes explicit malicious/typosquatted domains (e.g., attacker.com, evil.com, notatirtable.com), an unencrypted HTTP endpoint, and a raw install.sh intended for piping to sh — strong high‑risk indicators that make this set suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI explicitly discovers and fetches tool definitions from the MCP server at runtime (AIRTABLE_MCP_ENDPOINT default: https://mcp.airtable.com/mcp), and that fetched content directly controls the available tools/arguments an agent will see and invoke.