pp-intervals-icu

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill documents a CLI that syncs sensitive user fitness data locally and exposes configurable automatic delivery endpoints (webhook deliver + feedback endpoint auto-send), which can be abused to exfiltrate user data or tokens to arbitrary external servers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite/install steps run remote installers (e.g., "go install github.com/mvanhorn/printing-press-library/library/other/intervals-icu/cmd/intervals-icu-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/other/intervals-icu/cmd/intervals-icu-pp-mcp@latest") which fetch and execute remote code at runtime and are required to provide the CLI this skill depends on.