shipwright

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This is a personal/unknown GitHub repository referenced by install commands (npx/plugins) in the templates, which is a high-risk distribution vector since it would download and run third‑party code not from an established vendor or package manager registry.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). templates.md instructs installing and loading the external "shipshape" skill at runtime (via "npx skills add dmytri/shipshape" and "npx plugins add dmytri/shipshape"), which fetches and executes remote code and is referenced by https://github.com/dmytri/shipshape.