awesome-software-design-patterns

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Suspicious: the skill tells users to fetch and execute a remote shell script (https://d2lang.com/install.sh) and references a short/unknown domain (ara.so) — direct .sh downloads / curl|sh from third‑party sites and short/unknown domains are high‑risk vectors for malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.85). Flagged https://d2lang.com/install.sh because the skill explicitly instructs running "curl -fsSL https://d2lang.com/install.sh | sh", which fetches and immediately executes remote code at runtime as a required step for generating D2 diagrams.