plannotator-guide

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is a direct link to an install shell script (https://plannotator.ai/install.sh) which the docs instruct to pipe to bash — a high-risk delivery pattern because remote .sh files executed locally can deliver malware even if hosted on a project site.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime installation command that fetches and executes remote code via "curl -fsSL https://plannotator.ai/install.sh | bash -s -- --minimal", which is a required step to run the plannotator export commands and thus a remote-executed dependency.