compresso

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These are GitHub repositories/releases from third‑party/unverified user accounts that advertise prebuilt installers (DMG/MSI/AppImage) — direct executable distributions from untrusted GitHub accounts are higher-risk for malware distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes commands that fetch and execute remote code during installation (npx skills add https://github.com/akillness/jeo-skills which runs remote npx code, and git clone https://github.com/codeforreal1/compressO.git followed by pnpm install/build), so these URLs can cause remote code execution at runtime.