mise-project-isolation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill instructs running a shell installer piped directly from a remote host (curl -fsSL https://mise.run | sh), which downloads and executes code from the single opaque domain mise.run without providing repository, checksum, or provenance.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's first-time setup instructs: "curl -fsSL https://mise.run | sh", which fetches and pipes remote code from https://mise.run to the shell during runtime, making it a required external dependency that executes remote code.