readme-sync

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). This URL points to an unfamiliar third‑party domain and an account name with no established reputation, and the skill prompt encourages using npx to fetch/run packages (which executes remote code), so it could be used to distribute malware.