jabraf-workflows-npm-publish

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These are links to a third‑party GitHub repository and a reusable GitHub Actions workflow — not direct binaries, but reusing unknown workflows can be risky because they run code in your CI and may access secrets or perform malicious actions.