hyprland

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Yes — the list includes a raw install.sh piped to bash (raw.githubusercontent.com/.../install.sh) and a third-party binary mirror / unofficial repo (Event-Horizon-VL / mirror.black-hole.dev) used to distribute prebuilt packages, both of which are common vectors for untrusted/malicious binaries.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL explicitly instructs the agent at runtime to "fetch the latest docs from raw GitHub" (e.g. https://raw.githubusercontent.com/hyprwm/hyprland-wiki/main/content//.md and the example raw.githubusercontent.com URLs), which means external raw GitHub content is fetched and injected into the agent's context and thus can directly control prompts/answers.