rtk-token-saver

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw.githubusercontent.com link is a direct shell script download from a third‑party GitHub repo (risky to curl|sh or run without verification), whereas the w3.org/2000/svg URL is just the standard SVG namespace and not a download; because a remote install.sh is present this set is high risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script scripts/check-rtk.sh suggests installing the required "rtk" CLI by running curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh | sh, which fetches and executes remote code at runtime and the agent declares rtk as a required tool.