amazon-rufus-qa

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The raw.githubusercontent.com URL points to a remote .sh setup script that the skill automatically downloads and executes; fetching and running shell scripts from an unverified GitHub repository is a common malware distribution vector and therefore suspicious.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill downloads and executes a remote setup script from GitHub at runtime and uses a Chrome extension + local daemon to access authenticated Amazon pages, creating a high-risk supply-chain / remote-code-execution and potential data-exfiltration vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup wrapper (scripts/setup.sh) downloads and execs a remote script at https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh during runtime, which executes remote code and is required before tool use.