blaxel-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). This is risky: although hosted on raw.githubusercontent.com (a valid GitHub raw URL), it is a direct install.sh from an unfamiliar repository and the recommended curl | sh pattern lets arbitrary code run on your machine—inspect and verify the script and publisher before executing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime install instruction that fetches and pipes a remote shell script to the shell—curl -fsSL https://raw.githubusercontent.com/blaxel-ai/toolkit/main/install.sh | sh—which executes remote code to install the required bl CLI dependency, so this URL is a high-risk runtime external dependency.