kai-upgrade

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is suspicious: it points to an external GitHub repository from an unknown maintainer that the skill instructs to clone and run (./setup), allowing arbitrary remote code to be pulled and executed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill performs a runtime git pull and then runs a local setup script, which means it fetches and can execute changed code from the remote repository https://github.com/cgallic/kai-marketing.git, so the updater relies on external content that can control agent behavior/execution.