busybox-on-windows

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). These point to direct .exe downloads hosted on a third-party/personal site (frippery.org) rather than an official vendor channel, which is a common vector for distributing malware and should be treated as suspicious until verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs downloading and running a remote Windows executable from https://frippery.org/files/busybox/busybox.exe (and the related frippery.org busybox binaries) via Invoke-WebRequest, which fetches and executes remote code at runtime.