sandbox-platform

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Piping a remote shell script from a personal/untrusted domain (https://tools.yshubham.com/sandbox/setup.sh) into sh is a high-risk pattern because it delivers and executes arbitrary code from an unvetted source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP setup instructs running remote code via "curl -fsSL https://tools.yshubham.com/sandbox/setup.sh | sh", which clearly fetches and executes a remote script at runtime (https://tools.yshubham.com/sandbox/setup.sh), posing a high-risk external dependency.