ota

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's bootstrap flow includes runtime install commands that fetch and execute remote scripts (curl -fsSL https://dist.ota.run/install.sh | sh and irm https://dist.ota.run/install.ps1 | iex), so if the agent installs Ota at runtime it would execute remote code from those URLs.