no-mistakes

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a direct raw GitHub URL to an install shell script hosted in a user repository (kunchenguid) — running raw .sh from an untrusted or unknown GitHub account is risky because it can execute arbitrary commands, and the username/repo appear user-hosted rather than an established vendor.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime installation commands that fetch and execute remote code—specifically "curl -fsSL https://raw.githubusercontent.com/kunchenguid/no-mistakes/main/docs/install.sh | sh" and "go install github.com/kunchenguid/no-mistakes/cmd/no-mistakes@latest"—which would download and run external code to provide the required no-mistakes CLI.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly instructs running a remote install script that "installs/restarts daemon" (curl | sh) and other commands that modify local git remotes and push branches; the install/restart daemon step can modify system services and may require elevated privileges, so it poses a non-trivial risk to the host state.