edgespeak-karaoke

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a direct link to a shell installer (install.sh) that the skill instructs users to curl and pipe to sh — running remote shell scripts is a high-risk delivery method even when served from a project domain.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill documentation instructs running a remote install script via curl | sh (https://edgespeak.com/install.sh), which would fetch and execute remote code as a required CLI fallback dependency.