sap-dependency-security

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list contains two personal GitHub repositories (secondsky/*) referenced as source-installed MCP servers and a Windows PowerShell launcher — distributing executables from personal/unknown GitHub accounts is a high-risk vector for malware/supply-chain compromise.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flagged these URLs because the skill includes runtime commands that fetch and execute external code — e.g., git clone https://github.com/secondsky/sap_analytics_cloud_mcp (then npm ci && npm run build) and jscodeshift -t https://raw.githubusercontent.com/ReactTraining/react-router/main/packages/react-router/codemods/5.x-6.x.ts which downloads and runs a remote transform — indicating required runtime external content that executes code.