skill-security-auditor

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs point to attacker-controlled "evil.com" subdomains and include a direct .sh installer and data-exfiltration endpoints (pipe-to-shell and outbound POST/GET patterns), which are high-risk indicators for malware distribution and data theft.