configure-ecc

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a third‑party GitHub repository hosted under a personal account (affaan-m) rather than an official vendor; while it's a git repo (not a direct .exe), it can contain scripts or installers and should be treated as suspicious until you review its stars/commit history, contributors, file contents, and scan for executable scripts or malicious payloads before cloning/running anything.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs a runtime git clone of https://github.com/affaan-m/everything-claude-code.git to fetch ECC into /tmp, and the fetched repo contains SKILL.md files and scripts/hooks (e.g., continuous-learning) that are then copied and used to control agent behavior and may execute code, so this is a required runtime external dependency.