perfectpixel

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs point to third‑party GitHub repositories and direct release download endpoints (and a .git clone URL) that fetch/run prebuilt binaries from external accounts without built‑in signature/checksum verification — a common malware vector — though go.dev/dl itself is a trusted Go download page.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install script (scripts/install.sh) fetches and executes remote code at runtime from GitHub — it downloads a prebuilt binary from URLs like https://github.com/gykim80/perfectpixel-studio/releases/... or clones https://github.com/gykim80/perfectpixel-studio.git and builds/executes ppgen, which directly implements the prompt/generation logic used by the skill.