ci-cd-patterns

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). yourapp.com and the staging health endpoint are non-download placeholders, but the raw.githubusercontent.com links require caution — templated raw URLs can point to arbitrary repo content and the explicit raw.githubusercontent.com/tufin/oasdiff/main/install.sh is a direct shell installer (curl|sh), which is potentially unsafe unless the repository and maintainer are verified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflow explicitly runs a curl of a public install script (curl -fsSL https://raw.githubusercontent.com/tufin/oasdiff/main/install.sh | sh) and instructs tools to fetch remote OpenAPI files (via raw.githubusercontent.com URLs) as part of CI, which ingests and executes untrusted, public third‑party content that can change runtime behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The CI workflow runs curl -fsSL https://raw.githubusercontent.com/tufin/oasdiff/main/install.sh | sh at runtime, which fetches and executes remote code that the job depends on (installing oasdiff), so it is a high-risk external dependency.