setup-api-key

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). One of the URLs is a direct link to an installable shell script (curl ... | sh to https://astral.sh/uv/install.sh), which is a high-risk pattern for distributing malware because it executes remote code from an external domain.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a setup command that runs remote code via curl and sh ("curl -LsSf https://astral.sh/uv/install.sh | sh"), so https://astral.sh/uv/install.sh is a runtime external dependency that fetches and executes remote code.