verasic-fusion

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The raw.githubusercontent.com link is a direct download of a shell script (setup.sh) intended to be executed (the README even suggests curl | bash), which is a high-risk pattern for remote code execution from an external/unvetted GitHub user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). README.md includes an installation command that pipes and executes remote code from https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh (curl -fsSL ... | bash), which fetches and runs external code as part of setup.