install-dependency

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's install-js.sh script explicitly fetches and executes a remote installer via "curl -fsSL https://bun.sh/install | bash" (scripts/install-js.sh), which downloads and runs third-party content from the public web that can alter runtime behavior and thus enable indirect prompt-injection-like influence.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script install-js.sh runs a runtime fetch-and-execute (curl -fsSL https://bun.sh/install | bash) which downloads and executes remote code (the bun installer) as a required dependency, creating a high-risk external execution vector.