future-tokens

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to a personal GitHub repo plus a direct raw install.sh (invoked via the README's curl | bash pattern), which is a high-risk distribution vector because it encourages executing remote shell code from an unvetted account.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository includes a one-line installer that instructs: "curl -sL https://raw.githubusercontent.com/jordanrubin/FUTURE_TOKENS/main/install.sh | bash" and an install script that at runtime downloads the repository from "https://github.com/jordanrubin/FUTURE_TOKENS" (via curl/wget and tar), which is remote code fetched and executed during installation.