aap-lint

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a direct GitHub repository from an individual account that the skill instructs to clone/install (git clone / pip install -e), which is a potentially unverified source for executables or install-time code and therefore suspicious without further vetting.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires cloning and installing code from https://github.com/sibilleb/AAP-Enterprise-MCP-Server (Install: "git clone" + running the Python server via uv run ansible-lint.py), which fetches and then executes remote code that the skill depends on at runtime.