using-lwc

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The templated GitHub release/download URLs point to third‑party release artifacts that the installer will fetch as binaries (a common malware distribution vector), whereas the plain GitHub repo link and the Tolkien Gateway page are benign documentation links.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installer script is invoked at runtime (scripts/bootstrap.sh calls scripts/install-lwc.sh) and downloads and installs a binary from GitHub (e.g. "https://github.com/${repository}/releases/latest" / "https://github.com/${repository}/releases/download/${tag}"), which fetches and executes remote code.