remo-setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These are GitHub-hosted repos and a raw install script from a single, unfamiliar username (yjmeqt) — including a releases-hosted install-remo.sh intended to be fetched-and-executed — which is a common, potentially risky distribution pattern unless you verify the repo, signature, and reputation first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs running a remote install script via curl-and-bash (bash -c "$(curl -fsSL https://github.com/yjmeqt/Remo/releases/latest/download/install-remo.sh)"), and it requires fetching and executing external code during setup/build from https://github.com/yjmeqt/remo-spm.git, https://raw.githubusercontent.com/yjmeqt/remo-spm/main/Remo.podspec and git+https://github.com/yjmeqt/Remo.git, so these URLs are runtime dependencies that download and execute remote code.