omnicaptions-translate

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The instruction installs a package from a custom GitHub Pages PyPI index URL (https://lattifai.github.io/pypi/simple/), which is a common vector for typosquatting and supply chain attacks via third-party package repositories.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The setup instructions instruct the agent to run a pip install command retrieving a package from a custom GitHub Pages index (https://lattifai.github.io/pypi/simple/), constituting an unverifiable external repository dependency with weak provenance.