agent-token-efficiency

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw PowerShell installer URL (raw.githubusercontent.com/.../install.ps1) that is intended to be piped to iex is a high-risk direct-execution download, and the associated JuliusBrussee/caveman GitHub repo is the source of that installer — together they represent a suspicious download/execution vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes explicit install-time commands that fetch-and-execute remote code or install external skills that run at agent runtime (e.g., git clone https://github.com/Keep-maker/agent-token-efficiency-skill.git and irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex and pip installs using --index-url https://pypi.org/simple), so external content would be retrieved and can execute or control agent behavior.