claude-skills-library-expert

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Suspicious — the set includes a personal GitHub repo plus a direct raw.githubusercontent.com link to a shell installer and instructions that pipe/execute remote scripts (bash <(curl ...), running ./scripts/*.sh) which are high-risk vectors for malware if the source or scripts aren't verified; the other links (Medium, example.com, ara.so, myapp.com) are lower-risk but don't remove the danger of executing unreviewed remote scripts.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly fetches and executes remote install scripts and repository code at runtime (e.g., git clone https://github.com/alirezarezvani/claude-skills.git and bash <(curl -s https://raw.githubusercontent.com/alirezarezvani/claude-skills/main/scripts/openclaw-install.sh)), which downloads and runs external code the skill relies on.