aurakit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These URLs point to a personal GitHub repository and an npm package that instruct users to run an install.sh or npx from an unverified account — both are untrusted sources that can easily distribute malicious code if executed.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install instruction runs "git clone https://github.com/smorky850612/Aurakit.git && cd Aurakit && bash install.sh", which fetches remote code and then executes its install.sh, so the repository URL directly controls runtime behavior.