getting-started

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This is a direct link to a shell installer (install.sh) on a third‑party domain — piping or running such scripts without inspecting them is high risk because they can execute arbitrary commands; treat as suspicious unless you verify the domain and review the script contents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill includes runtime commands that fetch-and-execute remote code (curl -LsSf https://astral.sh/uv/install.sh | sh) and installs/runs a remote npm package via npx (npx skills add marimo-team/marimo-pair ...), both of which are required at runtime and will execute external code.