web-js-env-patcher

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Several URLs point to personal/third‑party GitHub projects (unknown user accounts and repo clones) which are common vectors for distributing tooling or scripts that could include malware; treat them as suspicious until validated, especially .git clones and third‑party tooling repos referenced for installation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes explicit install/runtime commands that will clone and install remote repositories (which fetch and execute remote code) — specifically git clone https://github.com/WhiteNightShadow/camoufox-reverse-mcp.git and cloning https://github.com/lwjjike/xbsReverseSkill as part of an automated installation plan — indicating runtime external dependencies that can execute code.