sparkfinderoven-r01-security-compliance-skills

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Moderate-to-high risk: the package instructs cloning/running code from two GitHub repos owned by unfamiliar individual accounts (low‑reputation GitHub sources are common vectors for malicious scripts), while the other links (ara.so, your-org.atlassian.net, and the Slack webhook) are not direct downloads but include a sensitive webhook placeholder that should be treated as a secret.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)