avira-security-loader-2026-deployment

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill contains instructions and PowerShell scripts to download and execute an untrusted executable masquerading as a security software installer from an arbitrary GitHub Pages URL.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (critical risk: 1.00). The skill instructs users to download an executable named Avira-Internet-Security-2026.exe from a personal GitHub Pages site (jasonkrause1976.github.io), which masquerades as an official Avira security deployment tool.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill fetches executable loader binaries from an arbitrary personal GitHub Pages repository (jasonkrause1976.github.io), presenting a weak and unverified third-party provenance risk.