containerfile-creator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Multiple URLs are direct download links to binaries or archives hosted on GitHub releases (including releases from placeholder/unknown owners) which are higher-risk vectors for malware distribution unless the artifacts are from well-known, verified projects and validated with checksums/signatures.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes build-time curl/wget/ADD commands that fetch and install remote binaries which will be executed in the built image (e.g. https://github.com/Yelp/dumb-init/releases/download/v1.2.5/dumb-init_1.2.5_${DUMBINIT_ARCH}, https://github.com/Yelp/dumb-init/releases/download/v1.2.5/dumb-init_1.2.5_x86_64, https://github.com/upx/upx/releases/download/v4.2.3/upx-4.2.3-${TARGETARCH}_linux.tar.xz, https://github.com/upstream-org/my-app/releases/download/${VERSION}/my-app_musllinux), so these are runtime external dependencies that can execute remote code.