semantius-admin

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set includes direct-install scripts served from raw.githubusercontent.com (install.sh, install.ps1) and other installer-style URLs (bun.sh/install) plus ambiguous personal/truncated GitHub links, which are high-risk to execute without verification even though several entries (official GitHub release pages for yq/jq and semantius domains) look legitimate.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow ingests only user-provided URLs via curl into .tmp_admin/.../incoming.md (Step 2) and then moves that fetched outsider-authored markdown into semantius/blueprints/ or semantius/specs/ for the analyst/modeler to read, which is indirect prompt-injection exposure through remote free text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Preflight step explicitly installs required tooling at runtime by downloading and executing remote install scripts (e.g. curl -fsSL https://bun.sh/install | bash, curl -fsSL https://raw.githubusercontent.com/semantius/semantius-cli/main/install.sh | bash, and PowerShell irm https://raw.githubusercontent.com/semantius/semantius-cli/main/install.ps1 | iex) and fetching binaries from GitHub release URLs (yq/jq), so these external URLs are fetched-and-executed as required runtime dependencies.