kvcore-mcp-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The link points to an unvetted GitHub repository owned by an unfamiliar account and the skill is installed via npx (which executes remote code), so although GitHub is a common code host this is an untrusted source that could be used to distribute malicious scripts.