lazyweb

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (critical risk: 1.00). The skills contain instructions to run a curl-to-bash installation script from https://www.lazyweb.com/install.sh, which downloads and executes software.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skills/lazyweb-apply-design-best-practices/SKILL.md workflow instructs the agent to search external sites (site:reddit.com, site:x.com, site:news.ycombinator.com) and fetch arbitrary outsider-authored instruction files from remote URLs during the refresh protocol.