ai-tools-setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Two of the listed URLs are direct installer scripts (install.sh and install.ps1) that, if executed blindly, can run arbitrary code and therefore present a high-risk download vector even though they appear on the vendor site.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs running remote install scripts that are fetched and executed at runtime via "curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash" and "iex (irm https://hermes-agent.nousresearch.com/install.ps1)", so those URLs directly deliver and execute remote code.