microsim-matcher
Warn
Audited by Snyk on Jun 22, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill performs a runtime version check and can auto-download the referenced matching-criteria.md from GitHub (via the GitHub API URL https://api.github.com/repos/dmccreary/claude-skills/commits?path=skills/microsim-matcher/references/matching-criteria.md&page=1&per_page=1 and the raw file URL https://raw.githubusercontent.com/dmccreary/claude-skills/main/skills/microsim-matcher/references/matching-criteria.md), and that fetched file directly controls the generator scoring/recommendation logic used at runtime (i.e., it changes the agent's instructions/behavior).
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata