google-search-extension

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The loopback health URL is benign, but the raw.githubusercontent.com link downloads and executes a shell script from a third‑party GitHub repo (FinpeakInc) — fetching and running .sh directly from an unvetted GitHub account is a common malware delivery vector and therefore suspicious.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The scripts download and execute a remote setup script (curl -> bash/exec) from a live GitHub raw URL with no integrity checks, creating a clear supply-chain and remote code execution/backdoor vector that could install malware or exfiltrate data; the rest of the code is benign wiring to a local Frevana daemon but can be abused if the downloaded installer is malicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill downloads and executes an outsider-authored setup script from a public GitHub URL at runtime (scripts/setup.sh fetches https://raw.githubusercontent.com/.../setup.sh), and that script can feed arbitrary free text into the agent via the subsequent frevana call frevana_ask results.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bundled scripts/setup.sh downloads and execs remote code at runtime from https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh, so required external content is fetched and executed.