portolan-thumbnails

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The script clones and npm-installs a third-party GitHub repository (https://github.com/Kanahiro/chiitiler) and runs its code locally — an external code source that can execute arbitrary scripts and is therefore a high-risk download/execution vector; the other URLs are public tile/CDN, license, or localhost endpoints and are not suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The script performs a runtime git clone from https://github.com/Kanahiro/chiitiler, runs npm install, and then executes the fetched code (npx tsx src/main.ts), so remote code is fetched and executed during skill runtime.