apollo-mcp-server

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Two URLs (https://mcp.apollo.dev/download/nix/latest and https://mcp.apollo.dev/download/win/latest) are direct installer endpoints that the guide tells users to pipe into a shell/PowerShell (curl ... | sh, iwr ... | iex), a high-risk distribution pattern even for otherwise legitimate domains.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Quick Start installation runs remote installers that are executed at runtime via shell/PowerShell (curl -sSL https://mcp.apollo.dev/download/nix/latest | sh and iwr 'https://mcp.apollo.dev/download/win/latest' | iex), so these URLs fetch and execute remote code.