lunar-client-minecraft-launcher

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These links point to a GitHub release providing a ZIP that likely contains a Windows executable from an unverified/unknown account (Bartates) plus an unvetted ara.so domain — direct distribution of executables from non-official GitHub repos and instructions to run as administrator are high-risk and commonly used to deliver malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The PowerShell install/update scripts fetch and expand executable archives at runtime from GitHub release URLs (e.g. https://github.com/Bartates/lunar-client-minecraft/releases/download/minecraft-client/LunarClient.zip and https://github.com/Bartates/lunar-client-minecraft/releases/latest/download/LunarClient.zip) and then run the launcher/setup, so remote code is downloaded and executed as a required dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill repeatedly instructs running with elevated Administrator privileges (Start-Process -Verb RunAs, "Always run as Administrator"), checks/enforces admin in scripts, and modifies system security settings (Add-MpPreference to add AV exclusions), which pushes the agent to obtain elevated privileges and change system state.