crm-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a raw GitHub-hosted install script (curl | sh) from an unknown user/repo that downloads precompiled binaries — a high-risk pattern because running remote scripts and unknown executables can deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install step runs a remote shell script via curl -fsSL https://raw.githubusercontent.com/dzhng/crm.cli/main/install.sh | sh, which fetches and immediately executes remote code at runtime, and is required to install the tool.