codexisland-macos-notch

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to a third‑party GitHub repo/releases and a Homebrew tap that distribute an unsigned macOS .dmg with explicit Gatekeeper/quarantine bypass instructions (high‑risk behavior), while a couple of API endpoints (anthropic.com) look legitimate but do not mitigate the risk of running an unsigned binary from an unknown author.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly instructs users to strip the Gatekeeper quarantine attribute (xattr -dr ...) and describes a manual Gatekeeper bypass for unsigned apps, which is a direct instruction to circumvent macOS security mechanisms even though it doesn't request sudo or create users.