resume-tailor

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The docs.anthropic.com link is official and low-risk, but the other two point to a personal GitHub repo and a raw install.sh (a direct shell script that people commonly pipe to curl|bash); unvetted GitHub repos and running remote .sh installers are high-risk unless you inspect the script and trust the author.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README instructs running curl -fsSL https://raw.githubusercontent.com/nishilbhave/ats-resume-tailor/main/install.sh | bash which fetches and executes a remote install.sh that in turn clones https://github.com/nishilbhave/ats-resume-tailor.git during installation, so the skill's install flow executes remote code fetched at runtime and thus is a high-confidence runtime external dependency.