soia-dev-ai-cli-upgrade

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include direct installer scripts and curl|bash endpoints (e.g., chatgpt.com/codex/install.sh, opencode.ai/install, antigravity.google/cli/install.sh) which are high-risk for distributing malware if they are not verified official vendor endpoints.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The upgrade script fetches and executes a remote installer at runtime via curl + bash in install_agy (installer_url="https://antigravity.google/cli/install.sh"), so the skill downloads and runs remote code from that URL.