recover-deleted-claude-conversation

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). All three URLs point to third-party GitHub repositories (one used as an npx package source and one as a git clone/pip source); installing or executing code directly from unvetted GitHub accounts can run arbitrary code and is a common malware distribution vector, so treat them as suspicious until validated.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md explicitly instructs cloning and installing https://github.com/cclgroupltd/ccl_chromium_reader.git (git clone ... then pip install), which fetches and installs remote code that the skill imports/executes to parse cache files and is a required dependency.