sun-path

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This points to a GitHub repo under an unknown/low-reputation user (not an official vendor) and the skill is installed via npx (which will execute remote code), so it’s a suspicious source that could distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The SKILL provides an install command "npx clawhub@latest install sun-path" which will fetch and execute remote code from the npm package (clawhub) at install/runtime, and also references the GitHub commit URL https://github.com/spooky-may/chaleaclawskill/tree/main/public/skills/qrost/sun-path, so it relies on external code fetched and executed.