desktop-notifications

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub URL is a personal/unvetted repository used as a direct install source (a high-risk distribution vector); the other URL is an internal API endpoint and not a download source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The installation step fetches and installs remote code from git+https://github.com/lirrensi/agent-sommelier, which the skill relies on and would execute when installed/used.