backend

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to a third‑party GitHub repo and a raw install.sh that the skill instructs users to curl | bash (a high‑risk pattern for remote code execution) from an individual account rather than an established vendor.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains a manual install fallback that runs a remote install script via curl -fsSL https://raw.githubusercontent.com/PadaliyaSavan88/api-forge/main/install.sh | bash -s backend, which fetches and executes remote code during installation.