make-moonbit-c-bindings

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The URL is a direct archive download from a non-official/placeholder domain (example.com) with no verified publisher or real checksum provided, so it could deliver arbitrary/malicious code and is therefore suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow includes running python3 scripts/prepare.py, whose template downloads and extracts upstream C sources from a runtime URL (urllib.request.urlretrieve(UPSTREAM_URL, ...)) and then reads their text (src.read_text()) to rewrite and vendor it into src/—this upstream free text is outsider-authored and becomes LLM-readable prose via the generated vendored files (e.g., src/upstream#... .c/.h) that the agent may subsequently inspect/ingest.