superset

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). One URL is a benign IETF RFC reference, but https://superset.sh/cli/install.sh is a direct install.sh shell script (recommended to be piped to sh) from an external domain — running unverified remote shell scripts is a high-risk distribution vector for malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill advises installing the CLI by piping a remote script to the shell using curl -fsSL https://superset.sh/cli/install.sh | sh, which fetches and executes remote code at runtime (installation) and therefore is a direct, required external dependency.