code-security
Fail
Audited by Snyk on Jul 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.70). These URLs point to a small/personal GitHub repository (and its raw content) that instructs cloning/running installer scripts and fetching files directly from raw.githubusercontent — a common, legitimate distribution method but also a high-risk vector for executing untrusted code from an unknown/individual account.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The README instructs cloning and/or curling SKILL.md from remote URLs that are fetched during installation and can execute/install remote code or supply the Skill definition that controls agent behavior — e.g. https://github.com/KimYx0207/Kim_Service.git and https://raw.githubusercontent.com/KimYx0207/Kim_Service/main/skills/semgrep-skill/SKILL.md.
Issues (2)
E005
CRITICALSuspicious download URL detected in skill instructions.
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata