matlab-integrate-pytorch-vision

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list includes a direct Git clone and a GitHub release asset (.pth) hosted under an unverified/individual GitHub account (ZhengPeng7), which is an untrusted source for executable/model weights and a common vector for malware distribution; the other URLs are official/vendor-hosted and lower risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads outsider-authored free text by “fetch[ing] and analyz[ing] the GitHub repository” (README/example/scripts/setup files), which are authored by repository submitters and can contain arbitrary text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes MPyReq at runtime to download and install remote code and model weights (e.g., https://mathworks.com/matlabcentral/fileexchange/182230-matlab-based-python-requirements-manager and git+https://github.com/facebookresearch/sam2.git), so these external URLs will fetch and install/execute third‑party code required for the skill to run.