solo-metrics-track

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a personal GitHub path from an unknown account that instructs users to run an npx command (which executes remote code) for an untrusted package, so it could be used to distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The install instruction ("npx clawhub@latest install solo-metrics-track") will fetch and execute remote code from the npm registry (the clawhub package) at install/runtime, which is a required external execution of remote code.