daft-worktree-workflow

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Multiple URLs in the list contain obvious injection/control-character patterns, path traversal, or command-injection tricks (nulls, backspace/escape sequences, ;rm/&&whoami, huge/fuzzed hostnames) which are suspicious and commonly used to exploit parsers or deliver malicious payloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit installer commands that fetch and execute remote scripts (high-risk runtime remote code execution), e.g. https://github.com/avihut/daft/releases/latest/download/daft-installer.sh and https://github.com/avihut/daft/releases/latest/download/daft-installer.ps1 which are used in examples like "curl … | sh" and "irm … | iex".