roadbook

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.85). These URLs include direct downloads of prebuilt binaries (tar.gz) from a likely small/unknown GitHub user (mnhkahn) with curl|untar install instructions—which is a common malware distribution pattern and therefore suspicious, while the cyeam.com page and the Microsoft device login link themselves look legitimate but do not mitigate the risk of the unknown GitHub assets.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The install step fetches and installs a remote executable from GitHub (e.g. https://github.com/mnhkahn/cyeam-cli/releases/latest/download/cyeam_Linux_x86_64.tar.gz), which is a required dependency that will execute code locally when used by the skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). Yes — the prompt instructs installing a third‑party CLI with sudo (sudo mv to /usr/local/bin) and running system CLI commands that modify the host environment and store tokens, so it explicitly asks to change system state requiring elevated privileges.