configure-ecc

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This URL points to a personal/unverified GitHub repository (affaan-m/everything-claude-code) which is not an official vendor source — cloning and running files from such repos can introduce scripts or binaries that may be malicious unless the repo is audited and trusted.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs "git clone https://github.com/affaan-m/everything-claude-code.git" at runtime to fetch the ECC repository, whose SKILL.md files and accompanying hooks/scripts (e.g., continuous-learning hooks) will be copied into and used by the agent and thus can directly control prompts or execute remote code.