rust-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Suspicious: it's a direct download of an installer shell (prek-installer.sh) from a GitHub release under a single username (j178) — downloading and piping unknown shell installers from non-official/verified sources is high-risk unless you've verified the repo and inspected the script first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Makefile's pre-commit-hooks target runs curl -LsSf https://github.com/j178/prek/releases/latest/download/prek-installer.sh | sh which, when the target is invoked, fetches and immediately executes remote code as part of installation, so it is a runtime external dependency that executes remote code.