officeCLI

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These are direct raw GitHub scripts (install.sh and install.ps1) that the skill instructs users to pipe into shell/PowerShell (curl|bash, irm|iex), which is a high-risk pattern for delivering and executing unreviewed code from an unverified repository.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The SKILL includes install/update commands that fetch and immediately execute remote scripts (curl -fsSL https://raw.githubusercontent.com/iOfficeAI/OfficeCLI/main/install.sh | bash and irm https://raw.githubusercontent.com/iOfficeAI/OfficeCLI/main/install.ps1 | iex), which runs remote code at install/runtime.