soia-design-explorer

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). This is a third‑party GitHub repository (alchaincyf/huashu-design) referenced as an installable dependency (via npx), and installing/running code from an unknown external GitHub account can execute arbitrary code and is commonly used to distribute malware unless the upstream is audited.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly reads the upstream SKILL.md and several reference files from the external huashu-design repository (https://github.com/alchaincyf/huashu-design), so content from that external repo is used at runtime to control agent behavior.