buildin-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The CDN URLs point to remote install scripts (one PowerShell .ps1 and one shell install endpoint) that the skill explicitly instructs to execute (irm|iex, curl|bash), a high-risk pattern because running fetched scripts can deliver malware if the host or content is compromised; the other URLs (api.buildin.ai and example.com/report.pdf) are not direct installers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs running remote installers at runtime that execute fetched code (curl -fsSL https://cdn.buildin.ai/buildin-cli/install | bash and irm https://cdn.buildin.ai/buildin-cli/install.ps1 | iex), so these URLs directly fetch and execute remote code required to install the CLI.