pp-learn-disabled-example

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The README points to a GitHub release that distributes pre-built installer/binary bundles (a .mcpb and platform binaries) from a user-maintained repository — GitHub releases containing executables from non-official/personal repos are a common malware distribution vector and should be treated as suspicious until the publisher and artifacts are verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime installation instructions that fetch and execute remote code (e.g., downloading the CLI/binary from the GitHub release https://github.com/mvanhorn/printing-press-library/releases/tag/learn-disabled-example-current and via npx), so it relies on external content that can execute code during setup.