ubs

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The raw.githubusercontent.com link points to an install.sh from an individual/unfamiliar GitHub user (direct shell script download/execute is a high‑risk delivery vector) and the second URL is malformed, so together they are suspicious and should be treated as high risk until verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The GitHub Actions workflow contains a runtime install step that runs curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/master/install.sh" | bash (and a similar curl | bash placeholder in the GitLab CI example), which fetches and immediately executes remote code during skill runtime, so it directly executes external code.