supsub-group

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is a raw .sh installer hosted in a third‑party GitHub repo and the skill explicitly instructs piping it into bash (curl ... | bash), which is a high-risk pattern for distributing malware from an unvetted source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README instructs installing by running a runtime fetch-and-execute command that downloads and pipes a remote shell script to bash (https://raw.githubusercontent.com/SupSub-AI/supsub-cli/master/scripts/install.sh), which executes remote code during setup.