weekly-report-repos

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The GitHub URL is high-risk because it references a personal/unknown repository used as a source for executable/CLI code, while the docs.astral.sh link is just vendor documentation and not suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime command explicitly uses uvx --from git+https://github.com/mjkimR/weekly-report@v0.2.0 which fetches and executes remote code from that GitHub repository at runtime, so an external URL controls executed code.