ruler-progress-render

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Suspicious — the script clones an unfamiliar GitHub repo (sxhzju/ruler-progress-animator) and then runs npm install and repository npm scripts, which can execute arbitrary remote code and pose a supply-chain/malware risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clones and updates a remote Git repository at https://github.com/sxhzju/ruler-progress-animator.git at runtime and then runs its code (npm install / npm scripts / npx remotion), so remote content is fetched and executed during skill runtime.