soia-pkm-transform

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs point to third‑party GitHub repositories (and GitHub-hosted files) — including an unofficial CLI/agent (teng-lin/notebooklm-py) and an open-design repo — which are not official vendor binaries and can be used as install sources for executables/CLI tools, so they present a moderate-to-high risk if you blindly run install commands or execute delivered code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repo contains explicit runtime bootstrap/install commands that fetch and run remote code (git clone / install) from https://github.com/nexu-io/open-design.git and https://github.com/teng-lin/notebooklm-py, so these URLs can be used at runtime to retrieve and execute external code.