quien-whois-lookup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Although ara.so looks like a homepage, the presence of a direct installer script (https://apt.quien.dev/install.sh) intended to be curl‑piped into sudo sh is a high‑risk pattern because it executes remote code with elevated privileges and can deliver arbitrary/malicious payloads.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly shows the agent will fetch and parse untrusted public internet data (RDAP/WHOIS, DNS, HTTP headers and the actual HTML for tech-stack detection, plus PeeringDB/BGP lookups) — e.g., "Tech stack from HTML" and the JSON subcommands — which the agent is expected to read and can materially influence subsequent decisions or actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install steps include a fetch-and-execute command (curl -fsSL https://apt.quien.dev/install.sh | sudo sh) and a Go module install (go install github.com/retlehs/quien@latest), both of which retrieve and run remote code as required dependencies for the skill.