dependency-management

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Mixed risk: the astral.sh link is high-risk because it is a direct remote install.sh intended to be piped to a shell (downloading and executing remote scripts is dangerous), docs.renovatebot.com is low-risk (official documentation JSON), and the GitHub repo is moderate-risk (GitHub source is normal but an unknown/org placeholder repo could host vulnerable or malicious code).