foal-full-clean

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is a direct raw GitHub URL to a PowerShell installer script in a personal repository (an untrusted executable distribution vector) and should be treated as high risk unless the repository and script are explicitly verified (checksums, signatures, or known, reputable source).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill downloads and executes a remote PowerShell installer at runtime from https://raw.githubusercontent.com/CoreyLyn/Foal/main/scripts/install.ps1, which directly runs fetched code and thus controls execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs downloading/running an installer and executing Foal with --allow-permanent and --allow-servicing to perform irreversible filesystem deletions and Windows servicing (which may require UAC/elevation), directly modifying the machine state.