chatgpt-ask

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The localhost health URL is benign, but the raw.githubusercontent.com link is a direct shell script download from a third‑party GitHub repo (FinpeakInc) that the wrapper will fetch and execute — downloading and running remote .sh from an unfamiliar account is a high‑risk pattern that can distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's scripts/setup.sh downloads and then execs the remote setup script at https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh during runtime (curl ... -o ...; exec bash "$setup_file"), so required remote code is fetched and executed.