jobs-track

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These are direct raw GitHub links to .sh and .ps1 installer scripts that the skill instructs users to pipe into bash/PowerShell—executing remote scripts from a repository without review is a high-risk distribution vector even if hosted on GitHub.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes runtime install commands that fetch and execute remote scripts (curl ... | bash and irm ... | iex) from https://raw.githubusercontent.com/solid-company/solid-jobs-skills/v0.6.0/scripts/install-sjctl.sh and https://raw.githubusercontent.com/solid-company/solid-jobs-skills/v0.6.0/scripts/install-sjctl.ps1, which directly execute external code required for the skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs users to fetch and execute remote install scripts (curl ... | bash and PowerShell irm ... | iex), which run arbitrary code and can modify the host system's state, so it poses a significant risk of compromising the machine.