detecting-typosquatting-packages

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several URLs point directly at registry entries for obvious typosquatted package names (e.g., "reqeusts" and "loadsh"), which are common vectors for malicious packages and should be treated as high-risk download sources.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads outsider-authored free text from PR/diff-provided dependency names via .github/workflows/typosquat-gate.yml piping into python scripts/agent.py screen ... --stdin, and scripts/agent.py then tokenizes and screens those arbitrary strings against the corpus.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install instructions instruct cloning and building/running remote repositories (e.g., git clone https://github.com/rustfoundation/typomania and git clone https://github.com/IQTLabs/pypi-scan), which fetches and executes third-party code that the workflow lists as required tooling (also referencing https://github.com/ecosyste-ms/typosquatting-dataset and https://github.com/microsoft/OSSGadget), so these URLs represent runtime external code dependencies that will be executed.