roblox-testing

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This is a direct raw GitHub link to an install.sh (a shell script often piped to sh) from a third-party repo/user — such scripts can run arbitrary commands, so unless you have verified and inspected the repository and author, it is suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The GitHub Actions CI pipeline includes a runtime command that fetches and executes remote shell code via "curl -LsSf https://raw.githubusercontent.com/nicbarker/aftman/main/install.sh | sh", which downloads and runs external code as a required CI step.