ad-creative-engine

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub URL points to a personal/unverified repository that is used to distribute a packaged skill (.skill) and install instructions (a plugin-like artifact that can contain arbitrary code), which is a potential vector for malware distribution compared with the other listed official/vendor links.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code intentionally auto-uploads any local file paths found in manifest *_url / *_urls fields to fal.ai (via fal_client.upload_file), logs request arguments to a local JSONL log and renders absolute file paths into a browsable HTML — together these deliberate behaviors create a clear data-exfiltration/secret-leak surface (and the repo intentionally ignores .env and generation artifacts), so the package is high-risk for unauthorized local-file exfiltration if a crafted manifest is run.