gtm-tools

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The bundle instructs piping a remote shell script (https://api.gtm-tools.sh/extension/install.sh) directly to bash — a high-risk pattern because it executes code fetched from a non-official domain without inspection.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow calls external, outsider-authored content via LinkedIn/Reddit connected-session tools (i.e., API responses from api.gtm-tools.sh that include posts/comments/user text) which the agent would place into LLM context; the provided files themselves only describe setup/contracts and do not show direct prompt injection handling.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). SKILL.md contains a runtime installation step that executes remote code via "curl -fsSL https://api.gtm-tools.sh/extension/install.sh | bash", which fetches and runs a script from that URL as part of setup.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes payment-related operations: it documents metering ($1 = 100 tokens) and provides a buy_tokens API (example: {"amount_usd":25}) and a set_auto_reload option. Those calls allow the agent to initiate real monetary top-ups/recurring reloads, i.e., move money or trigger charges, which is direct financial execution capability.