catalyst-sdk

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub URL points to a third‑party user repo used as a CocoaPods source (unverified personal account) which is a higher‑risk distribution vector; the remaining URLs are official docs/CDNs or placeholders and are low risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The web setup includes a runtime script tag that loads and executes remote JavaScript from https://static.zohocdn.com/catalyst/sdk/js/4.6.1/catalystWebSDK.js, which is fetched at client runtime and therefore executes external code.