wzrrd-publish

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most URLs are static discovery files on a single domain (low risk), but the presence of an install.sh intended to be fetched and piped to bash (curl … | bash) is a high‑risk distribution pattern that can deliver malware unless you independently verify the domain and upstream source (wzrrd-sh/wzrrd-cli) and the script contents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install step explicitly instructs running curl -fsSL https://wzrrd.sh/install.sh | bash which fetches and immediately executes remote code to install the required wzrrd CLI, so this URL is a runtime external dependency that executes code.