zabbix-mcp-server

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs include a GitHub repository from an individual user (mpeirone) that the skill instructs you to fetch and run locally (uvx/git clone), which poses a moderate-to-high risk if the repo/account is unvetted—there are no obfuscated redirects or passworded archives and the other domains are placeholders or a vendor domain (ara.so), but running unreviewed code from an unknown GitHub account can distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime installation commands (e.g., uvx --from git+https://github.com/mpeirone/zabbix-mcp-server@main and git clone https://github.com/mpeirone/zabbix-mcp-server.git) fetch and install/execute code from a remote GitHub repository which is a required dependency, so remote content will be executed at runtime.