write-upl-prompts

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These are direct GitHub release artifacts (zip/tar.gz) containing executables from a personal GitHub repository — a common and convenient distribution method but one that can be used to deliver malware unless the release provenance, checksums/signatures, and repository trustworthiness are verified.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing the upl binary system-wide using sudo (e.g., "sudo install upl /usr/local/bin/upl"), which requests elevated privileges and modifies system files on the host.