mole-cleaner

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The raw.githubusercontent.com install script (curl -fsSL ... | bash) hosted in a personal GitHub repo is a high-risk distribution vector—running a remote shell script directly is commonly used to deliver malware even if the repository itself appears legitimate.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes an installation command that fetches and pipes a remote script to a shell (curl -fsSL https://raw.githubusercontent.com/tw93/mole/main/install.sh | bash), which would execute remote code at runtime if run.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs the agent/user to perform privileged system modifications (clean /var/log and system caches, stop/remove LaunchAgents/Daemons, remove swap/restart paging), to configure Touch ID for sudo, and even to run an external install script (curl | bash), all of which change machine state and can require or obtain elevated privileges.