codegraph

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list contains direct raw.githubusercontent.com links to install.sh and install.ps1 (executable install scripts commonly piped to sh/iex), which are high-risk vectors for malware distribution even if other links are documentation or GitHub pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Quick Start and installation docs instruct running "curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh" and the PowerShell equivalent "irm https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1 | iex", which fetch and execute remote scripts at runtime and are presented as the recommended installation (required) path.