pitch-deck-visuals

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Suspicious — the curl | sh installer hosted on cli.inference.sh (and the related inference.sh domain) is an unverified direct-execute download from an unfamiliar domain, and the GitHub commit is from a non-obvious/unknown account, which together match common high-risk indicators for distributing malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Quick Start includes a runtime command that downloads and executes remote code via curl -fsSL https://cli.inference.sh | sh (installing the infsh CLI), and the skill then relies on that CLI to run remote apps, so https://cli.inference.sh is a required runtime dependency that executes fetched code.