paper-collage-ad

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two URLs stand out as potentially risky: ark.cn-beijing.volces.com looks like a possible typosquat/unknown API host for a video-generation endpoint, and a direct install script (https://astral.sh/uv/install.sh) is a remote shell installer — both are common vectors for malware or supply‑chain compromise if they are not trusted/verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). This skill contains installation/runtime steps that fetch and execute remote code for the optional local TTS path — e.g. curl -LsSf https://astral.sh/uv/install.sh | sh and the setup script that clones https://github.com/solar2ain/mlx-indextts.git (used by scripts/setup-indextts2-mlx.sh) to install and run third‑party TTS runtime and models.