lean-ctx

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The raw.githubusercontent.com URL is suspicious because it points to a direct install.sh shell script from a third‑party GitHub repository (a common malware vector when fetched/pipe-to-bash), while the apache.org links are official and benign.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md setup directs users to run a curl | bash command that fetches and executes remote code from https://raw.githubusercontent.com/yvgude/lean-ctx/main/skills/lean-ctx/scripts/install.sh, which is a runtime external dependency that can install hooks and change agent behavior.