llm-index

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL points to a GitHub repository owned by an unverified/unknown account and the workflow explicitly runs code directly from the repo (uvx --from git+https...), which enables remote execution of arbitrary code and is therefore a suspicious download/execution source.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly invokes uvx to fetch and execute code at runtime from git+https://github.com/varlabz/mindex (uvx --from git+https://github.com/varlabz/mindex ...), so it executes remote repository code as a required runtime dependency.