debugging-code

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include direct GitHub release download and release-API endpoints tied to a personal/unverified repository (AlmogBaku/debug-skill) which is a common vector for distributing prebuilt binaries from an individual account and therefore presents elevated risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flagged runtime installer downloads because the install script and docs fetch and install remote code (e.g., the script calls curl on "https://api.github.com/repos/$REPO/releases/latest" and then downloads "https://github.com/$REPO/releases/download/$LATEST/$ASSET_NAME", and references/installing-debuggers.md downloads the js-debug tarball), which directly retrieves and installs/extracts executable code at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill explicitly advises disabling macOS System Integrity Protection ("csrutil disable") to allow attaching to a process, which instructs modifying a core security mechanism and thus compromises the machine's state.