wechat-2d-render

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL is a GitHub repository under an unfamiliar username that this skill will clone and then run pnpm install and project scripts (which can execute arbitrary code), making it potentially unsafe.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime script clones and uses the remote repository https://github.com/sxhzju/wechat-2d.git and then runs pnpm install and pnpm scripts, which fetches and executes code from that remote repo.