tilt

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The external raw GitHub URL (raw.githubusercontent.com/my-org/...) is potentially suspicious because it points to a remote Tiltfile that would be fetched and executed with full local privileges and originates from an unspecified/third‑party org; the other URLs are official Tilt or well-known vendor/CDN resources.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains an explicit runtime remote code fetch that will be executed: references/extensions-and-teams.md shows load_dynamic('https://raw.githubusercontent.com/my-org/tilt-shared/main/common.tiltfile') which fetches and executes a remote Tiltfile at runtime, and the install docs include a curl -fsSL https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh | bash which downloads and executes a remote installer script.