harbor-task-creator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Yes — one URL is an unanalyzed internal HTTP MCP endpoint (http://mcp-server:8000/mcp) and the other is a direct link to a remote install.sh (https://astral.sh/uv/0.9.7/install.sh); executing or piping remote shell scripts (and calling unverified local HTTP endpoints) is high-risk because they can deliver arbitrary code with no vetting.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's test scripts run at runtime and explicitly execute a remotely fetched installer via "curl -LsSf https://astral.sh/uv/0.9.7/install.sh | sh", which runs remote code and is required for installing test tooling used by the verifier.