email-design

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to an unfamiliar third‑party CLI (inference.sh) and raw GitHub install docs — patterns that often use shell installers (curl | sh) which can execute arbitrary code from an untrusted source, so treating them as potentially dangerous is warranted (the third URL is just a generic CTA link and not itself an installer).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires and invokes the inference.sh CLI (https://inference.sh) at runtime via commands like "infsh app run" (e.g., falai/flux-dev-lora), which executes remote apps/models and therefore runs external code that controls the skill's behavior.