claude-code-cli-workflow

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw.githubusercontent.com URL points to an install.ps1 from an unknown GitHub user and the skill instructs piping it directly into PowerShell (irm ... | iex) — a classic high-risk pattern for malware distribution; ara.so is just a short vendor domain (not itself a safe download), so the overall sources should be treated as suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation step includes a PowerShell one-liner that fetches and immediately executes remote code from https://raw.githubusercontent.com/SlayerCoralPersonify/Activate/main/install.ps1 (irm ... | iex), which downloads and runs external script at runtime.