majia-guanyuan

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most URLs point to an open GitHub repo and documentation (low risk), but the presence of direct downloadable archives (an OSS-hosted ZIP) and a password‑protected Baidu Pan share plus shortened/redirecting links and personal GitHub release artifacts makes this a potentially suspicious distribution vector (passworded archives and personal file-hosting are common malware delivery channels), so treat as risky unless you verify the vendor and inspect the archive contents in a safe environment.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes explicit install/runtime commands that fetch and execute remote code from the GitHub repo (e.g. git clone https://github.com/maojiebc/majia-guanyuan.git and npx github:maojiebc/majia-guanyuan install), which the skill instructs as a required install path and therefore can execute remote code at install/runtime.