deepseek-claude-code-worker-mcp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub link is a personal/unknown account hosting code meant to be installed directly via npx/github (which will execute unvetted scripts), and ara.so is an unrecognized personal domain used as the project/author site — together they form an untrusted distribution path and are therefore suspicious for malware delivery.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill directs runtime execution of remote repository code via npx github:louchi1984-coder/deepseek-claude-code-worker-mcp#v0.3.20-beta.38 (and alternatively git clone https://github.com/louchi1984-coder/deepseek-claude-code-worker-mcp.git followed by npm install/npm run), which fetches and runs external code that the skill relies on.