whatsapp-triage

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). All but one URL are official WhatsApp or W3C links or examples; the single risky item is a direct git install from an individual GitHub repo (https://github.com/KnugiHK/iphone_backup_decrypt) which is a third‑party source fetched directly from a user account and therefore a higher-risk install vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs the user at runtime to run python3 -m pip install git+https://github.com/KnugiHK/iphone_backup_decrypt, which fetches and installs remote code (executing third‑party code on the user's machine) and is presented as a required dependency for handling encrypted iPhone backups.