screenshot

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The install instruction pulls code directly from an unvetted GitHub repository (github.com/lirrensi/agent-sommelier) under an unfamiliar username, which is a high-risk vector for executing malicious code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's installation step fetches and installs remote code from git+https://github.com/lirrensi/agent-sommelier which would download and install/execute third-party code as a required dependency, so it is a runtime external dependency that can execute remote code.