lca-deepagents

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs are direct links to installer scripts (.sh and .ps1) that are executable when piped to a shell/PowerShell and therefore pose a high risk of running arbitrary/malicious code if the source is not fully trusted.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime MCP client calls that fetch tool definitions from https://docs.langchain.com/mcp and https://api.githubcopilot.com/mcp/ (these tools are loaded into the agent at runtime and affect its behavior), and the setup instructions tell users to clone and run code from https://github.com/langchain-ai/lca-deepagents.git and to run remote install scripts from https://astral.sh/uv/install.sh and https://astral.sh/uv/install.ps1 which fetch and execute remote code locally.