kadath

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The Hugging Face smolagents URL is from a reputable organization and likely low risk, but the KADATH links point to a personal/unverified GitHub repository (i3T4AN) that the skill instructs users to clone and run scripts from—personal GitHub repos and instructions to run repo-provided shell scripts increase the risk of malicious code execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs users to run "git clone https://github.com/i3T4AN/KADATH.git" and then execute the fetched repository's scripts (e.g., ./kadath.sh), so the remote GitHub repo (https://github.com/i3T4AN/KADATH.git) is a runtime-fetched code dependency that will execute code on use.