agent-mail

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.95). The presence of a raw GitHub URL to an install.sh (downloadable shell script) combined with a curl | bash install pattern from an unknown/small GitHub user is high risk (direct execution of untrusted .sh), while the 127.0.0.1 URLs point to a local service—but they are not safe if populated by that untrusted installer.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's recommended one-liner runs remote code via curl|bash (https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail/main/scripts/install.sh?$(date +%s)), which fetches and executes a script at install/runtime and therefore presents a direct code-execution dependency.