sparkfinderoven-security-compliance-suite

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This set is suspicious: it instructs cloning and executing code from an unverified GitHub repo with an odd username/repo name (potentially new/typosquat), references unreviewed ara.so skill downloads, and includes webhook/env integrations — all high-risk patterns for distributing malicious scripts/binaries.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install/CI steps explicitly git-clone and then execute binaries from the remote repository (https://github.com/sparkfinderoven/r01-hesreallyhim-awesome-claude-code-security.git), so runtime-fetched content is executed and thus is a required external dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill includes examples that modify system-level locations (e.g., /etc/cron.d/security-scan, writing to /var/log) and automated containment/credential-rotation actions which imply changing system state and may require elevated privileges, so it poses a moderate risk.