se-dev-torch

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include remote install scripts and a direct .exe download from third-party domains (astral.sh and frippery.org) which are fetched and executed by the preparation scripts—this is a high-risk pattern for malware distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's preparation scripts fetch and execute remote installers at runtime (curl/wget piped to sh and PowerShell Invoke-Expression), notably https://astral.sh/uv/install.sh and https://astral.sh/uv/install.ps1, and download an executable from https://frippery.org/files/busybox/busybox64u.exe which the skill then uses—these remote fetches are executed during Prepare and are required for the skill to run.