iii

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The presence of a direct link to an executable shell script (https://install.iii.dev/iii/main/install.sh) which the prompt instructs to pipe to sh is a high-risk pattern (remote .sh execution), while the localhost /health and /users/123 endpoints are local service URLs and not download hosts; unless install.iii.dev is a verified, trusted source you should treat that installer as potentially malicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Quick Start instructs running a runtime command that fetches and executes remote shell code via curl -fsSL https://install.iii.dev/iii/main/install.sh | sh, which directly executes remote code and is presented as a required install path.