atlas-migrations

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). https://atlasgo.sh is a direct installer-script URL (curl to a .sh then run) which is a high-risk distribution vector if the source or script is compromised; https://atlasgo.io/getting-started is a documentation page and is not itself a download risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install step downloads and then executes a remote install script (curl -sSf https://atlasgo.sh -o install-atlas.sh followed by sh install-atlas.sh), which fetches and runs remote code at runtime, so it is flagged.