logmind

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is a direct download link to an install.sh script (recommended in-place with "curl | bash") hosted on a project domain—fetching and executing remote shell scripts is a high-risk distribution vector for malware unless the source is fully trusted and audited.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). SKILL.md includes an installation command "curl -fsSL https://logmind.dev/install.sh | bash" (line 166) which fetches and immediately executes remote code, and the skill expects the logmind tool to be present, so this URL can run remote code during setup.