council

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The links are GitHub repositories and a skills.sh skill page (not direct .exe downloads) which lowers immediate severity, but several come from individual/unknown accounts and the skill text explicitly references running install scripts/NPX (install.sh/install.ps1), which would execute untrusted code on your machine — making these moderately-to-highly risky if you run their installers without review.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow can fetch public web content via the last30days and deep-research companion skills (public pages/articles scraped at runtime), which are outsider-authored free text that the sub-agents ingest into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — the skill explicitly requires invoking external companion skills at runtime (Scout runs https://github.com/mvanhorn/last30days-skill and the Fact Checker runs https://github.com/199-biotechnologies/claude-deep-research-skill), and the content they fetch is injected into agent prompts and used to control the decision process.