thirdparty-web-interface-guidelines

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The attribution file instructs users to run a remote shell script via "curl ... | bash" from https://vercel.com/design/guidelines/install, which is a high-risk pattern (downloading and executing a remote script) even if the domain appears legitimate.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). Includes a remote "curl | bash" install and instructions to fetch raw remote files — this enables arbitrary remote code execution and is a high-risk supply‑chain / post‑install attack vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes runtime instructions that fetch and execute remote content — specifically an install command that pipes https://vercel.com/design/guidelines/install to bash and an update step that fetches https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md — so external code/content would be executed/used at runtime.