security-scan

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Both URLs point to a third‑party npm package and a personal GitHub repo (affaan‑m/agentshield) that are unverified sources for an executable npm package run via npx, which presents a supply‑chain/malware risk unless you trust the author and have audited the code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires running npx/npm and a GitHub Action which fetch and execute remote code (e.g., the referenced AgentShield package at https://github.com/affaan-m/agentshield and https://www.npmjs.com/package/ecc-agentshield), so these runtime dependencies can execute external code.