cm

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include direct executable/release downloads and raw install shell scripts served from personal GitHub repositories (and a GitHub releases .exe), which are high-risk to run (especially via curl|bash) because they can easily distribute malware and originate from a non-mainstream personal account.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High-risk: the agent guidelines explicitly instruct agents to obey an overriding "I am in charge" directive (bypassing safeguards), and the docs describe automatic offloading of builds to a fleet of remote Contabo VPS workers and an MCP server that can be exposed — patterns that enable backdoor-like control and potential data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, cm context "<task>" --json hydrates historySnippets by calling safeCassSearch(...)/“cass search” over prior session logs and includes their free-form text (historySnippets[].snippet) into the LLM context, allowing poison if an outsider can cause those cass-indexed sessions/snippets to be ingested.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flagged this because the docs include explicit installer commands that fetch and execute remote scripts (curl ... | bash) from https://raw.githubusercontent.com/Dicklesworthstone/cass_memory_system/main/install.sh and https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh, and a git clone of https://github.com/Dicklesworthstone/cass_memory_system.git which pulls remote source that is then built/executed during installation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly includes system-modifying installation steps (curl | bash installer), suggests system-wide installs that use sudo to move binaries into /usr/local/bin, and shows commands that install hooks, cron jobs, and a network-exposed service (0.0.0.0) — all instructions that can change machine state and require or encourage elevated privileges or persistent system changes.