material-design-3-ui

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include direct raw.githubusercontent.com links to install.sh/install.ps1 plus unpinned/raw-template URLs and a git clone URL from an unverified GitHub user — remote executable scripts (and commands that pipe them to a shell) from an external repo are a high-risk distribution pattern that can deliver malware if the source is not trusted or pinned.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill’s installers and README include runtime fetch-and-execute commands that download the skill package and installer scripts from raw.githubusercontent.com (e.g., https://raw.githubusercontent.com/skydashnet/material-design-3-ui-skill/main/install.sh and https://raw.githubusercontent.com/skydashnet/material-design-3-ui-skill/main/install.ps1) and git clone URLs (https://github.com/skydashnet/material-design-3-ui-skill.git), which at runtime retrieve SKILL.md and related files that directly control agent instructions and can be executed (curl | bash / irm | iex), so this is a runtime external dependency that controls prompts/code.