use-semantius

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These include direct raw.githubusercontent.com links to install.sh and install.ps1 (remote shell/PowerShell scripts) which are a common malware distribution vector when executed blindly (especially via curl|bash or irm|iex), and the tests.semantius.app URL is an application link rather than a vetted package source — treat as suspicious unless you can verify the GitHub repo and its maintainers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL explicitly directs installing the required semantius CLI at runtime by fetching and executing remote installer scripts (curl -fsSL https://raw.githubusercontent.com/semantius/semantius-cli/main/install.sh | bash and PowerShell irm https://raw.githubusercontent.com/semantius/semantius-cli/main/install.ps1 | iex), which downloads remote code that would be executed and the skill depends on the CLI to run.