new-project-setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Directly downloading a prebuilt binary tarball from a GitHub release (rtk-ai/rtk) and extracting it to /usr/local/bin without checksum/signature verification is risky — it's an unverified third-party binary distribution that could be used to deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill contains a runtime curl that downloads and extracts a binary from https://github.com/rtk-ai/rtk/releases/latest/download/rtk-x86_64-unknown-linux-musl.tar.gz (lines 35-36), which fetches and installs remote executable code during setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill instructs downloading and extracting a binary into /usr/local/bin (lines 35–37) and running rtk init -g (lines 39–41), which modify system-wide locations and configurations that typically require elevated privileges.