setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These are direct GitHub release tarballs from an unverified/unknown repository that deliver prebuilt native binaries and the prompt instructs curl-and-extract into your PATH—GitHub hosting is common but prebuilt executables from unfamiliar authors without signatures or provenance checks are a moderate-to-high risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup script downloads and installs prebuilt binaries at runtime from GitHub (e.g. https://github.com/open-horizon-labs/repo-native-alignment/releases/latest/download/repo-native-alignment-linux-x86_64.tar.gz) and also suggests installing from the repo via git (https://github.com/open-horizon-labs/repo-native-alignment), which are fetched/installed during runtime and will execute as required dependencies, so they constitute a high-risk remote-code dependency.