training-lecture-transcript

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a personal GitHub repository (not a known vendor or popular OSS project) that contains scripts and is intended to be installed/run via npx — while not an obvious binary or password-protected archive, installing or executing code from an unvetted personal repo can run arbitrary code and is therefore potentially risky.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md includes an installation command that runs remote code via npx from https://github.com/peter-tu-zynkr/zynkr-skill-builder, which would fetch and execute external skill code that defines agent prompts/instructions and is therefore a runtime dependency controlling the agent.