plannotator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Several URLs point to direct installer scripts and executables hosted on a project domain (plannotator.ai/install.sh, .ps1, .cmd) and a GitHub repo from an unvetted username — remote install scripts and unknown-source repositories are common malware distribution vectors (especially when recommended to be piped to shell/PowerShell).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow routes the user to review concrete plans/diffs/markdown artifacts and launches plannotator review/plannotator annotate (e.g., via scripts/review.sh), meaning outsider-provided text can be ingested when it is contained in that chosen artifact (e.g., a user-supplied plan/diff/markdown to be reviewed).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installer script runs curl/powershell to fetch and execute remote installers (e.g., curl -fsSL https://plannotator.ai/install.sh | bash and irm https://plannotator.ai/install.ps1 | iex), which are runtime remote-fetch-and-execute operations that directly execute code from https://plannotator.ai.