python-security-hardening

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most URLs point to legitimate, well-known GitHub projects or the reserved example.com domain, but the list includes a clearly malicious-looking domain (evil.com) and a personal/less-established GitHub repo (melvinmt/skills) which could be used to distribute untrusted executables — so the overall set contains suspicious sources and should be treated with caution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The README instructs running "npx skills add melvinmt/skills" which fetches and executes code from the repository https://github.com/melvinmt/skills during install, so this is a runtime external dependency that executes remote code.