subway-info

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The installation command downloads and executes code from https://skills.sh/subway-info via a piped bash execution, presenting a potential supply chain risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill utilizes helper scripts that execute inbound runtime HTTP requests to subwayinfo.nyc to fetch API data and service responses, but the publisher provenance of this domain is weak, unknown, and unverified.