agentspace

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — it's a direct link to a shell script on a non-well-known domain and the skill recommends piping it to bash (curl ... | bash), a high-risk pattern that can distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes a runtime installation command "curl -fsSL https://agentspace.so/install.sh | bash" which fetches and executes remote code from https://agentspace.so/install.sh to install the required ascli tool.