supsub-deepread

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw GitHub URL points to an install.sh script intended to be fetched and piped to bash (a high-risk pattern from a third‑party repo), while the supsub.net /s/ share page is a public content URL and not itself an executable.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). 在 Workflow A/B/C/D 中，运行 LLM 精读所用的文本来自 sub contents / focus contents / search 返回的 contentId 对应内容，并且显式要求 contentId 只能来自本轮这些“真实返回”；所见文本属于经过选择的内容项而非对任意 outsider 文本的直接摄取。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Prerequisites include a curl piped to bash that fetches and executes remote code from https://raw.githubusercontent.com/SupSub-AI/supsub-cli/master/scripts/install.sh, meaning remote content would be executed during setup and could control the agent environment.