github-workflow-automation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These GitHub repositories (ruvnet/ruv-swarm and ruvnet/claude-flow) are from an unfamiliar/unknown account and the skill directs use of alpha/npx packages tied to them, which are higher-risk distribution vectors for untrusted executables or scripts.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation instructs running untrusted npm packages (npx / npm install -g, alpha prereleases) inside CI and local setups, auto-generating and writing workflow files, and passing secrets/AWS credentials to those commands — patterns that enable supply‑chain compromise, remote code execution, and secret exfiltration if the third‑party packages are malicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime paths such as gh pr view ... --json files,labels (then passed as --pr-data into npx ruv-swarm actions pr-validate) ingest outsider-authored pull request content (files/labels) that can be submitted by anyone with PR access.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Commands in the skill (e.g., "npx ruv-swarm", "npx claude-flow@alpha", and "npm install -g claude-flow@alpha") and a workflow step that uses "ruvnet/swarm-action@v1" will fetch and execute remote package/action code at runtime, so the skill depends on external content that executes on runners.