cc-env-setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). deb.nodesource.com/setup_20.x is the official NodeSource installer (low risk), but the astral.sh install.sh and install.ps1 are hosted on an unfamiliar personal domain and are intended to be executed directly via curl|sh or iwr/iex — a high‑risk distribution pattern that could deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes setup commands that fetch-and-execute remote scripts at runtime (e.g., curl -fsSL https://deb.nodesource.com/setup_20.x | bash and curl -LsSf https://astral.sh/uv/install.sh | sh and irm https://astral.sh/uv/install.ps1 | iex), so external content is executed as part of the required installation.