nmt-upgrade

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to executable installer scripts hosted on an unverified personal domain and the skill instructs piping those scripts directly to bash/PowerShell (plus a background telemetry ping), which are high-risk patterns for malware distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs running remote code at runtime via curl/pipe and PowerShell from https://nextmovetheory.com/install.sh (and https://nextmovetheory.com/install.ps1), which downloads and executes an installer that updates the agent's canon/skills and therefore directly controls prompts and executes code.