release-changelog-harness

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Contains a direct raw GitHub URL to an install.sh script (curl | bash pattern) which is a high-risk, executable download vector that can be abused to distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documentation explicitly shows a runtime shell-install pattern that fetches and executes remote code via curl (curl -fsSL https://raw.githubusercontent.com/OWNER/REPO/main/install.sh | bash), which is a high-confidence remote-execute runtime dependency.