codegraph

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs point to raw installation scripts (install.sh and install.ps1) hosted in a personal GitHub repository and are intended to be fetched and executed directly — a high‑risk pattern because running remote scripts from an unverified source can deliver malware or undesired changes.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Quick Start and installation docs include curl/irm commands that fetch and pipe remote install scripts to a shell/PowerShell (https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh and https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.ps1), which download and execute remote code as a required installation step.