site-data-collector

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One of the URLs is a direct raw GitHub link to a .sh setup script (raw.githubusercontent.com), which is a direct-download/execute vector from an external repository and therefore a potentially suspicious malware distribution source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's scripts/download-and-exec pattern downloads and executes a remote setup script at runtime from https://raw.githubusercontent.com/FinpeakInc/frevana-cli-releases/refs/heads/main/skills/frevana/scripts/setup.sh (see scripts/setup.sh which curl's that URL and then execs the downloaded file), so remote code is fetched and run as a required dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly instructs the agent/workflow to download and run a bundled setup script (scripts/setup.sh) that fetches and executes the latest Frevana setup and runs a local daemon, which modifies the host system and installs services — i.e., it pushes execution of remote code that changes machine state.