dart-setup-ffi-assets

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a GitHub Releases download URL used to distribute precompiled binaries (a common malware vector) and the surrounding code relies on MD5 integrity checks and a generic/org template placeholder, making it potentially unsafe unless the repository/org is trusted and stronger verification (e.g., SHA‑256 + signed releases) is used.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's build hook downloads and registers precompiled native libraries at runtime from https://github.com/my-org/my-native-repo/releases/download/$version/$target, which fetches executable native code the package may load, so this is a runtime external dependency that can execute remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly instructs installing system toolchains (including the privileged command "sudo apt install build-essential"), which requires elevated privileges and modifies the machine state.