oz-platform

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill explicitly instructs running remote install scripts piped to a shell from third-party domains (curl -fsSL https://opencode.ai/install | bash and curl -fsSL https://app.factory.ai/cli | sh), which are risky delivery methods controlled by external sites though there's no evidence in the repo that they deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly tells agents to fetch live documentation at runtime (e.g., https://docs.warp.dev/llms.txt and other docs.warp.dev Markdown pages like https://docs.warp.dev/agents/capabilities/computer-use.md, https://docs.warp.dev/reference/cli.md, https://docs.warp.dev/reference/api-and-sdk.md), so external content fetched from those URLs can directly control agent prompts and behavior.