sovereign-rpg-xp-engine

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The link is to an untrusted GitHub repository/subdirectory from an unfamiliar user and the skill instructs using "npx clawhub@latest …" (which will fetch and execute code from npm), so this could be used to distribute malware if the GitHub/npm packages are unvetted.