git-ci

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This is a direct raw GitHub URL to an executable shell installer hosted in a personal repository (Sanix-Darker/git-ci.releases); raw .sh installers from unvetted personal repos are high-risk distribution vectors for malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup script downloads and executes remote installer code at runtime from https://raw.githubusercontent.com/Sanix-Darker/git-ci.releases/main/install.sh (curl -o ...; sh ...), so the skill fetches and runs external code that can control execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill instructs the agent to connect as root (e.g., "root@host") and to run setup/apply scripts (scripts/setup.sh --host ... and --apply) that change the remote host state and may require elevated privileges, which risks modifying system files or compromising the machine.