install-memory-powermem

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). They point to a raw shell script on a third‑party GitHub repo and the skill instructs piping curl to bash (directly executing a remote .sh), which is a high‑risk pattern because an unverified/unknown repository or its raw file can contain or be changed to contain malicious commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required installation step 5 instructs running curl -fsSL https://raw.githubusercontent.com/ob-labs/memory-powermem/main/install.sh | bash, which fetches and executes a public GitHub-hosted script (untrusted third-party content) that the workflow ingests and can materially change runtime behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime one-line installer that fetches and executes remote code via "curl -fsSL https://raw.githubusercontent.com/ob-labs/memory-powermem/main/install.sh | bash -s -y", which downloads and runs a script from GitHub.