jj-workspaces

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This URL points to a raw GitHub-hosted install.sh (intended to be run via curl | sh); while it's from a named GitHub user rather than an obviously random account, piping and running an arbitrary shell script from the internet is a potentially risky distribution method unless you trust the maintainer and have reviewed the script.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The reference includes an install command that fetches and pipes a remote shell script to sh (curl -fsSL https://raw.githubusercontent.com/tjarvstrand/dojjo/main/install.sh | sh), which executes remote code during setup to install the required djo dependency.