uv-package-manager

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The majority of links are to the official astral.sh/docs and the astral-sh GitHub repo (legitimate), but three generic/unknown GitHub URLs pointing at "github.com/user/..." are untrusted/placeholder git sources that could be used to pull and execute unvetted code and are therefore suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The playbook includes commands that fetch and execute remote install scripts (e.g., curl -LsSf https://astral.sh/uv/install.sh ...; sh "$tmpdir/uv-install.sh") and other remote content (PowerShell install.ps1, cargo --git, GHCR image), which are runtime external dependencies that execute remote code.