gha-security-review

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Multiple URLs are attacker-controlled or point to direct script installers (curl|bash) and appear in the skill prompt as examples of payload delivery used in real-world GitHub Actions exploits, so they are high-risk distribution endpoints.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository contents include numerous explicit malicious payload examples and patterns (curl|bash downloads, token exfiltration, Go init()/install hooks, npm/python install hooks, cron/SSH persistence, expression/filename injection) that demonstrate credential theft, remote code execution, and persistence/backdoor techniques — high-risk if reused or copied as-is.