verasic-github-cli-init

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The list contains a direct raw.githubusercontent.com link to a shell script (unsafe to curl|bash from untrusted sources) and a typosquatted domain (github.com.evil.com) which are both high-risk indicators for malware distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README and setup protocol instruct running remote-install code via curl -fsSL https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/setup.sh | bash which fetches and executes remote code at install time, making it a runtime installation dependency that executes external code.