gki-kernel

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These include a third‑party GitHub repo and a raw GitHub-hosted shell script that the skill instructs to fetch and pipe to bash (curl | bash), which is a high-risk pattern for distributing malware; the android.googlesource.com manifest is an official vendor source and not flagged.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally downloads and pipes an external setup.sh into bash to install KernelSU-Next (a root/privilege-escalation module) and even advises disabling verified boot, which constitutes remote code execution and enabling of backdoor-style privileged access.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The build helper explicitly fetches and pipes a remote shell script to bash at runtime using https://raw.githubusercontent.com/KernelSU-Next/KernelSU-Next/refs/heads/dev/kernel/setup.sh (see scripts/build_gki_ksun.sh and the example in REFERENCE.md), which executes remote code as part of the required KernelSU-Next integration.