cali-agents-md-generator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Direct download of a prebuilt binary tarball from a GitHub release owned by an untrusted/unknown account (Ataraxy-Labs) is a high-risk vector for distributing unverified executables.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The GitHub Actions workflow downloads and extracts a remote sem binary at runtime using curl from https://github.com/Ataraxy-Labs/sem/releases/latest/download/sem-linux-x86_64.tar.gz which fetches and installs/executables remote code in CI.