zero

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a direct installer shell script (install.sh) served from a single third‑party domain (zerolang.ai) and piping such a script to bash is inherently risky because it can execute arbitrary code and the domain is not a widely recognized vendor.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill directs users to run "curl -fsSL https://zerolang.ai/install.sh | bash", which fetches and directly executes remote install code from https://zerolang.ai/install.sh as a required setup step for the skill.