skill-security-scanner

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs are suspicious because the list includes multiple high-risk endpoints (attacker-server.com, malicious.com, data-collector.evil.com, and an HTTP payload.sh) that are clear exfil/download vectors and direct-script hosts, even though a few entries (api.anthropic.com, github.com/raw.githubusercontent.com, ara.so) are legitimate — overall treat the set as high risk.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)