free-code-claude-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs are suspicious because they include an unknown GitHub repo plus a raw install.sh explicitly recommended to be run via "curl | bash" (direct download-and-execute), together with an IPFS mirror fallback and instructions that strip telemetry/guardrails — all classic high-risk indicators for malware or backdoors despite some benign-looking links (bun.sh, api.anthropic.com).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install commands fetch and execute remote scripts (e.g., curl -fsSL https://raw.githubusercontent.com/paoloanzn/free-code/main/install.sh | bash and curl -fsSL https://bun.sh/install | bash), which run remote code as part of setup and are required to install/use the skill, so they present a high-risk runtime-executed dependency.