pyenv

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub links point to the official, well-established pyenv repository (low risk), but https://pyenv.run is an external installer script referenced with "curl https://pyenv.run | bash", which is a risky distribution method (remote script execution) and should be treated as suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install instructions include a "curl https://pyenv.run | bash" command which fetches and executes remote code at runtime (references/install-and-setup.md:34), and the skill relies on pyenv being installed.