slb

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw.githubusercontent.com link points to an executable install.sh from an unvetted/unknown GitHub user (curl ... | bash is high‑risk because it runs whatever code is served), and while slack.com/webhook/ is not a download endpoint it appears as a placeholder webhook URL (not inherently malware but could be used for exfiltration), so the combined evidence is suspicious.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to request and execute arbitrary shell commands on the local machine (e.g., slb run "rm -rf ...", emergency-execute, curl|bash install, daemon/tcp execution), which enables modifying or destroying system state and running privileged actions on the host.