code-delivery

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a third‑party GitHub repository (idaibin/aicraft) referenced as a direct install source (npx skills add), which can deliver and execute code from an account with unknown reputation and no contextual vetting, so it could be used to distribute malware.