skill-downloader

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These sources include an unknown third-party site (skillhub.club) serving downloadable skill archives and several direct .zip/.skill archive URLs from non-official/unvetted domains, which are common vectors for distributing malware or tampered packages.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). This skill’s runtime workflow downloads outsider-authored skill packages from GitHub/URLs/archives, then reads outsider-provided SKILL.md (free text) via skill_md_path.read_text() during validation, making it available to the agent/LLM context if later ingested.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The downloader scripts fetch and install skills from remote URLs (e.g., https://github.com/anthropics/skills and https://example.com/my-skill.zip), which at runtime import arbitrary external skill content (SKILL.md plus optional scripts) that can contain agent prompts or executable code, so these external URLs are runtime dependencies that can directly control agent behavior.