habitat-usage

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). These URLs are suspicious because they point to direct executable downloads from a GitHub user/org (including a non‑pinned /releases/latest URL) and an unverified HTTP ZIP (example.com) with no integrity verification—patterns commonly used to distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation examples explicitly curl the Habitat binary from GitHub (e.g., https://github.com/lynx-family/habitat/releases/download/${HABITAT_VERSION}/hab and https://github.com/lynx-family/habitat/releases/latest/download/hab), saving it and marking it executable so running ./hab would execute remotely fetched code required for runtime.