modern-python

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to a personal GitHub account (j178) that is distributing a direct installer script and an unpinned GitHub Action — a common supply-chain / executable distribution risk (curl|sh installer + personal-action), so they should be treated as suspicious until vetted.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains installation commands that fetch and pipe remote installer scripts to a shell (e.g., https://astral.sh/uv/install.sh and https://github.com/j178/prek/releases/latest/download/prek-installer.sh), which would execute remote code during setup and are recommended for required tools (uv/prek).