gemini-ask

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The localhost /health URL is benign, but the raw.githubusercontent.com link fetches and is executed as a shell setup script from an external GitHub repo (FinpeakInc/frevana-cli-releases); while GitHub raw is common, automatically downloading and running an unverified third‑party script is a notable risk unless you verify the repo, release/tag, and script contents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's scripts/setup.sh downloads and then execs a remote shell script at runtime from https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh (curl -o ...; exec bash), so required external content is fetched and executed and can control the agent's behavior.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill requires running a bundled setup script that downloads and executes remote installer code and starts a local daemon/Chrome-extension integration (operations that commonly modify system state or require sudo), so it pushes the agent to perform potentially system-changing actions.