officecli-word-form

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — the presence of direct .sh/.ps1 install scripts hosted on the custom domain d.officecli.ai which the skill instructs users to pipe to bash/PowerShell (curl/irm | bash/iex) is a high-risk pattern for remote code execution; the GitHub releases link (unknown/unchecked account) may mitigate if it's legit but is unverified, while the schema URLs are benign.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime install commands that fetch-and-execute remote scripts (curl -fsSL https://d.officecli.ai/install.sh | bash and irm https://d.officecli.ai/install.ps1 | iex) when officecli is missing, so it depends on and executes code from https://d.officecli.ai/install.sh (and the corresponding PowerShell URL).