mdbook

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to a third‑party GitHub repository and its raw install.sh (the README suggests curling the script and piping to bash) — executing remote scripts from an untrusted/unknown account is a high‑risk distribution vector for malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). SKILL.md explicitly tells the agent to fetch docs at runtime from https://raw.githubusercontent.com/rust-lang/mdBook/master/guide/src/.md (and the example raw.githubusercontent.com URLs) to use as authoritative reference for answers, so external content fetched during runtime can directly influence prompts and outputs.