sts2mcp-slay-the-spire-2-ai-agent

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These links point to a personal GitHub repository and its releases which distribute compiled mod files (DLLs/executables) from an individual/unverified source, a common vector for malware distribution and thus higher risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install instructions tell the user to download and execute remote code (download the mod from https://github.com/Gennadiyev/STS2MCP/releases/latest and git clone https://github.com/Gennadiyev/STS2MCP.git followed by uv run ... python server.py), which fetches and runs third‑party code locally and is therefore a high-confidence runtime external code execution dependency.