nebulavault-media-downloader

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The set includes a direct download of a prebuilt Linux binary tarball from an unverified GitHub user/repo (github.com/Ronish17/.../nebulavault-linux-x64.tar.gz) — a common malware distribution vector — while the other URLs are mostly benign streaming/placeholder or localhost endpoints.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The installation steps explicitly download and run remote executables/source from GitHub (https://github.com/Ronish17/redbull-archive-cli/releases/latest/download/nebulavault-linux-x64.tar.gz and the git clone URL https://github.com/Ronish17/redbull-archive-cli.git), which fetch remote code that would be executed locally, so they are runtime external dependencies that execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt explicitly instructs privileged system changes (e.g., "sudo apt install ffmpeg", "sudo ufw allow 5600/tcp"), and suggests service/cron setup and writing logs to /var/log, which require elevated privileges and therefore push the agent to modify the host system state.