calicat-cli-operator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The design URLs point to web design pages on calicat.cn (likely benign), but the direct install.ps1 and install.sh are remote-install scripts served from a relatively small/unknown domain — direct-download-and-execute scripts from non-mainstream hosts are a common malware vector and should be treated as suspicious unless you can verify the publisher, inspect the scripts, or obtain them from a trusted package manager or signed release.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow uses the local calicat CLI to fetch Calicat design/PRD data (e.g., via get_design_data, get_meta_data, get_prd_full_content), which is outsider-authored free text from a public/third-party service and can be ingested into the agent’s LLM context through the CLI tool outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes explicit install commands that fetch and execute remote scripts at runtime (curl -fsSL https://www.calicat.cn/cli/install.sh | bash and powershell/irm https://www.calicat.cn/cli/install.ps1 | iex), which would run remote code if the agent follows the CLI-install path.