update-skills

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a GitHub repository under an unfamiliar username (qwibitai) rather than a known vendor; adding it as an upstream remote and merging its skill branches can introduce arbitrary code or build scripts, so treat it as suspicious until you verify the repo's owner, activity (stars/forks/commit history), and inspect commits before pulling or executing anything.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs git fetch/merge against an upstream remote (default URL: https://github.com/qwibitai/pepper.git) at runtime, which pulls skill branches that can modify agent prompts/behavior and inject remote code into the repository.