upkeep-audit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). This points to an individual GitHub repository (github.com/wei18/upkeep) that the skill instructs you to clone, run npm ci, and execute bundled scripts — running code from an unverified personal repo can execute arbitrary/malicious code and is therefore suspicious.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly clones and runs code from https://github.com/wei18/upkeep at runtime (git clone + npm ci and execution of ~/.cache/upkeep/scripts/local-audit.sh), meaning fetched remote code is executed and controls the agent's audit behavior.