verasic-git-commits-convention

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw.githubusercontent.com link is a direct install script (setup.sh) from an unvetted/individual GitHub repo that the README encourages piping to bash (curl | bash), which is a high-risk pattern for remote code execution and potential malware distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README instructs to run a direct fetch-and-execute install command that downloads and pipes remote shell code to bash (curl -fsSL https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh | bash), which executes external code at install/runtime.