core-web-vitals

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill contains an operational script import and dynamic module import that download executable JavaScript from an untrusted third‑party domain (https://heavy-widget.com/widget.js), which is a direct remote code fetch from a domain that does not match a known trusted vendor and could deliver arbitrary code.