perplexity-ask

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The localhost health URL is benign, but the raw.githubusercontent.com URL is a direct shell script download from an external GitHub repository (FinpeakInc) that the skill explicitly downloads and executes—downloading and running remote scripts from an unvetted/third‑party repo is a high-risk vector for malware distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill downloads and immediately executes a remote setup script (raw GitHub URL) without verification, creating a supply-chain risk that allows arbitrary code execution and potential backdoor/exfiltration by the fetched script.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bundled scripts/setup.sh is invoked at runtime and uses curl to download and then exec bash the remote setup script at https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh, meaning the skill fetches and executes remote code it depends on.