configure-ecc

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL is a direct git clone from an individual GitHub account (unknown/unaudited) and the SKILL instructs copying repository contents into user-level directories, which can deliver arbitrary scripts/configs—this is potentially unsafe without verification.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime installation step clones and relies on the remote repository https://github.com/loulanyue/awesome-claude-notes.git to supply SKILL.md and other skill/rule files that will be installed and thus directly control agent prompts/instructions, so this external fetch is a required runtime dependency.