security-scan

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Both links point to a third‑party GitHub repository and an npm package intended to be run via npx; because they are external, not clearly well‑established vendor artifacts, and invoke code execution (npx), they present a supply‑chain/malware risk until vetted.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires running npx/npm and a GitHub Action which fetch and execute remote code (e.g., the referenced AgentShield package at https://github.com/affaan-m/agentshield and https://www.npmjs.com/package/ecc-agentshield), so these runtime dependencies can execute external code.