steganography-techniques

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub .deb is a standard GitHub releases artifact (lower risk), but the StegSolve.jar link is a direct HTTP-hosted Java executable on a personal site (untrusted distribution channel and easy to tamper with), so it is suspicious to download and run without verification.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The guide contains install commands that fetch and execute remote code at runtime—specifically wget http://www.caesum.com/handbook/Stegsolve.jar (downloaded then run with java -jar), wget https://github.com/RickdeJager/stegseek/releases/latest/download/stegseek_amd64.deb (downloaded and installed), and go install github.com/lukechampine/jsteg@latest (pulls and builds remote Go code)—so these are runtime external dependencies that execute remote code.