busybox-on-windows

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include direct downloads of Windows .exe binaries from a third‑party domain (frippery.org) rather than a verified/official repository (even though busybox.net is referenced), which is a high‑risk pattern for potential malware distribution without independent verification (checksums/signatures/reputation).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The SKILL.md explicitly instructs downloading and running a BusyBox binary from public third-party URLs (Invoke-WebRequest to https://frippery.org/... in step 3), which clearly fetches untrusted external content that the agent would execute/use and could therefore influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime PowerShell commands download and install an executable from https://frippery.org/files/busybox/busybox64.exe (and related frippery.org busybox binaries), which fetches and will execute remote code as a required dependency.