3d-chladni-render

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The URL is an individual GitHub repository that the skill clones and then runs npm install and npm scripts (including an Electron exporter), which can execute arbitrary code from an unvetted source and is therefore a suspicious distribution vector.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The runtime script clones and updates the remote repository https://github.com/nolangz/3D-Chladni.git and then installs and executes its code (npm ci and npm run export:video), so remote content fetched at runtime is executed.