elephant-agent-personal-ai

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs point to a small/unfamiliar project that offers direct executable delivery (a GitHub-hosted .dmg) and an install script served at elephant.agentic-in.ai intended to be run via curl|bash—both high-risk distribution patterns unless you verify the publisher and release integrity (signatures/checksums, GitHub repo reputation, and source code review).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README includes installation commands that fetch and execute remote code—specifically "curl -fsSL https://elephant.agentic-in.ai/install.sh | bash" and repository/binary fetches like "git clone https://github.com/agentic-in/elephant-agent.git" and "https://github.com/agentic-in/elephant-agent/releases/latest/download/Elephant-Agent.dmg"—which run external code during setup and are required to install the agent.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)