autonomous-loops

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a direct raw.githubusercontent.com link to an install.sh (a remote shell script intended to be executed), which — while hosted on GitHub — is a high supply‑chain risk (especially when fetched from HEAD and executed via curl|bash) and can be used to distribute malware unless you fully verify the repository, script contents, and author trustworthiness.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Installation step instructs running curl -fsSL https://raw.githubusercontent.com/AnandChowdhary/continuous-claude/HEAD/install.sh | bash, which fetches and immediately executes remote shell code to install the continuous-claude tool (a required runtime component), so remote content can execute arbitrary code.