video-creator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). cdn.jsdelivr and w3.org are normal/trusted resources, but the two GitHub release assets (kokoro-v1.0.onnx and voices-v1.0.bin) come as direct binary downloads from an unfamiliar GitHub user (thewh1teagle) and therefore represent a higher-risk distribution channel that could deliver malicious or backdoored model/executable files unless you verify the repo, checksums, and publisher.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill loads and executes remote code at runtime via the GSAP CDN script (https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js) and by invoking npx to fetch/execute the hyperframes package (npx --yes hyperframes@0.6.51), both of which are required for runtime operation and run external code.