superset-10x

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL points to a direct shell installer (install.sh) on a non-official/unfamiliar domain and is suggested to be run via curl | sh, which is a high-risk distribution pattern for malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill suggests installing the CLI at runtime by running a remote install script fetched and executed via curl -fsSL https://superset.sh/cli/install.sh | sh, which would download and execute remote code during runtime.