From d40a017a4446e2f3b1581d46bcc00ebe82c78da8 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Fri, 27 Feb 2026 11:05:53 -0800
Subject: [PATCH] scanner: downgrade pipe-to-shell markdown pattern to warn

---
 src/security/skill-scanner.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/security/skill-scanner.ts b/src/security/skill-scanner.ts
index bac3f746aeac..c240dd1a4dd9 100644
--- a/src/security/skill-scanner.ts
+++ b/src/security/skill-scanner.ts
@@ -324,7 +324,7 @@ const SKILL_MD_RULES: MarkdownRule[] = [
   },
   {
     ruleId: "suspicious.script",
-    severity: "critical",
+    severity: "warn",
     message: "Pipe-to-shell pattern detected",
     pattern: /(curl[^\n]+\|\s*(sh|bash))/i,
   },