java-quarkus

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL https://gitingest.com/github.com/GoogleContainerTools/distroless points to a non-standard third‑party domain mirroring a GitHub repository (not an official GitHub/CDN domain) and thus is an untrusted mirror that could be used to host altered or malicious artifacts.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill specifies pulling container images at runtime (used as required base images) such as quay.io/quarkus/quarkus-distroless-image:2.0 which will be fetched and can execute remote code when run, so these external image URLs are runtime dependencies of concern.