harness-tour

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is a direct raw.githubusercontent.com link to a user-owned bootstrap .sh that the skill recommends piping to bash (curl|bash); executing an unknown remote shell script from a personal GitHub repo is a high-risk vector for malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill tells the user to run a curl-pipe-to-bash bootstrap command (https://raw.githubusercontent.com/Rheinmir/setup/orca/harness/poc-vendor-neutral/bootstrap.sh) to install the PoC at runtime, which fetches and executes remote code and is presented as a required dependency for the tour.