esm

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Three URLs are suspicious: a URL-shortener (bit.ly) that hides its target, an untrusted/custom Forge endpoint (custom.forge.instance.com) that could point to a malicious API or package source, and a GitHub install string with an unpinned/trailing "@" which implies a floating/unspecified commit (risk of executing arbitrary code from a non-fixed branch).