devcontainer-setup

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Two URLs point to direct downloads (an architecture-variable tarball and an install.sh) hosted on a non-official/example domain (example.com), which are high-risk for distributing binaries/scripts; the other two links are official documentation and are low risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The devcontainer feature references "ghcr.io/devcontainers/features/rust:1" and "ghcr.io/devcontainers/features/go:1" are added to devcontainer.json and will be fetched and executed during container setup (runtime), so they constitute external dependencies that run remote code.