doubao-ask

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw.githubusercontent.com URL pulls and executes a remote setup script from an external GitHub repository of unclear reputation (remote code execution risk), while the 127.0.0.1 health check is local and benign.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bundled scripts/setup.sh downloads and execs remote code at runtime from https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh (curl -o then exec bash), and ask_doubao.sh invokes that setup wrapper before every tool call, making the fetched script a required runtime-executed dependency.