claude-blog-brain

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include direct raw GitHub links to install scripts (shell/PowerShell) and GitHub release pages from project/user forks plus an explicit attacker domain — common vectors for distributing untrusted executables and for risky "curl | bash" installation patterns.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository includes a runtime sync step (scripts/sync_flow.py / the /blog flow sync command) that pulls prompt content from https://github.com/AgriciDaniel/flow which would fetch external markdown prompts that can directly control agent instructions, so this external URL is a runtime dependency that could influence agent prompts.