setup-scalekit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). While the docs URLs (llms.txt, apis.md, sitemap) are low-risk documentation, the presence of raw GitHub install.sh scripts (raw.githubusercontent.com/.../install.sh) intended to be fetched and piped to bash from an unvetted/unknown org is a high-risk pattern that could distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes explicit runtime installer commands that fetch and execute remote shell scripts (curl -fsSL https://raw.githubusercontent.com/scalekit-inc/codex-authstack/main/install.sh | bash and curl -fsSL https://raw.githubusercontent.com/scalekit-inc/cursor-authstack/main/install.sh | bash), so external content is executed at runtime and required for installation.