concurrent-cli-agents

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One URL (https://x.ai/cli/install.sh) is a direct link to an installable shell script that the skill recommends piping to bash (a high-risk executable distribution pattern); the other links are documentation or official provider pages.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains an install command that fetches and pipes remote code to a shell—curl -fsSL https://x.ai/cli/install.sh | bash—which would execute remote code at setup/runtime and is cited as the required installer for running Grok Build agents.