a2ui_developer_guide

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The majority of the URLs are documentation, official GitHub repos, and known package sites, but one URL is a direct shell installer (https://astral.sh/uv/install.sh) referenced in the quickstart — a curl|sh installer is a high-risk pattern because it executes remote code locally and is commonly abused to distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The quickstart includes commands that fetch and execute remote code (git clone https://github.com/a2ui-project/a2ui.git to obtain the demo repository and curl -LsSf https://astral.sh/uv/install.sh | sh to install uv), which are runtime/setup steps that download and run external code the demo relies on.