aspire

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The bundle includes a direct link to an install shell script (https://aspire.dev/install.sh) which, when fetched and piped to a shell, is a high-risk distribution vector for arbitrary/malicious code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites recommend running a curl-pipe-to-shell install command that fetches and executes remote code from https://aspire.dev/install.sh, which is a required installation step referenced in SKILL.md and thus a runtime-executable external dependency.