ax

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs point to a personal/non-official domain (ax.yusuke.run) that is used to deliver an install script piped to shell and direct downloadable binaries (precompiled installers) — a high-risk distribution pattern that can be used to deliver malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime the skill’s required workflow can call ax <url> --md/--outline/--row and ingest fetched page content (public/outsider-authored web text) into the agent’s LLM context as tool output used for subsequent prompting; this is an indirect prompt-injection exposure path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly instructs running a remote installer via shell piping (e.g., "curl -fsSL https://ax.yusuke.run/install | sh") which fetches and executes remote code at install/runtime, so https://ax.yusuke.run/install (and its download endpoints) are runtime external dependencies that execute code.