gsc-cli

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The repository URL git+https://github.com/AminForou/mcp-gsc is used as a package/source that the local wrapper will install and execute (supply-chain risk) and comes from a third‑party GitHub account rather than an official vendor, so it could be used to distribute malicious code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's wrapper invokes uvx to install and run a remote package at runtime from git+https://github.com/AminForou/mcp-gsc, which fetches and executes code (uvx --from ... mcp-gsc), so the external URL directly controls the agent's runtime behavior.