security-scan

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Both links point to a third‑party npm package and its personal GitHub repo (maintained by an individual account) that are installed/run via npx/npm and referenced as a GitHub Action—installing or running them executes code from an untrusted/low‑visibility source and therefore presents a moderate-to-high risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs running npx ecc-agentshield and using the GitHub Action affaan-m/agentshield@v1, which fetch and execute remote code from https://www.npmjs.com/package/ecc-agentshield and https://github.com/affaan-m/agentshield at runtime, so these external repositories/packages directly control code executed by the agent.