plugin-update

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The raw.githubusercontent.com template and the GitHub repo URL point to a third‑party, personal GitHub repository (kochetkov-ma/claude-brewcode) used as a plugin marketplace and as the source of plugin files — a non-official distribution source that can deliver executable plugin code and is therefore higher risk than official vendor/CDN links.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill executes marketplace/install commands at runtime that add and install plugins from https://github.com/kochetkov-ma/claude-brewcode and the fetch script runtime-curls raw plugin metadata from https://raw.githubusercontent.com/${REPO}/main which will cause remote plugin code/metadata to be fetched and thus can result in executing or installing remote code.