catalyst-sdk

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub URL points to a third‑party/personal repository (non-official username) being used as a package source for an SDK (CocoaPods), which is a common vector for unvetted/malicious code distribution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The web SDK is loaded at runtime via a script tag that fetches and executes remote JavaScript (https://static.zohocdn.com/catalyst/sdk/js/4.6.1/catalystWebSDK.js) and an accompanying init script (/__catalyst/sdk/init.js) which auto-initializes the SDK, so these URLs deliver code executed during runtime.