stelow-product-shape-up

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Both URLs point to an unknown GitHub user's installer (a raw PowerShell script) and a releases page — the README recommends piping the raw .ps1 into an executor (irm | iex), which is a high-risk pattern for arbitrary remote code execution and common malware distribution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In standalone mode, the user can supply an arbitrary problem statement that the skill uses as the shaping anchor (“User provided a problem statement? → Use it directly as the shaping anchor”), and that free text is ingested by the LLM at runtime.