devup-ui

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a third‑party GitHub repository (https://github.com/akillness/jeo-skills) used as an install source (npx/git clone/installer script) from an unknown user — such repos can deliver and execute arbitrary scripts, so treat as suspicious until verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install helper calls "npx skills add https://github.com/akillness/jeo-skills" (REPO_URL) at runtime, which fetches and installs remote skill code that can change agent behavior/instructions, so this is a runtime external dependency that controls the agent.