claude-code-cli-workflow

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The set includes a direct raw GitHub URL to a PowerShell install.ps1 (commonly used with "irm ... | iex") from an unknown account—a high-risk pattern for silent malware execution—and the referenced GitHub repository is from an unfamiliar user (potentially containing install scripts), even though git-scm.com and ara.so themselves are legitimate; overall the presence of the remote .ps1 makes this a suspicious download source.