install-mcp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The URL is a GitHub repository from a generic/unknown owner ("author") — while GitHub is a common source, unknown repos are a supply-chain risk (possible typosquatting, post-install scripts, or malicious code) and should undergo the full security gate before cloning or executing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow’s “Security gate (external sources only)” step runs oss-security-check on a user-supplied external URL/repo/package (e.g., GitHub/npm/PyPI), and that assessment can ingest outsider-authored free text from the fetched repository/package contents into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's runtime workflow explicitly fetches and runs remote code (e.g., "git clone https://github.com/author/mcp-server.git" and registry installs like "npx @author/mcp-server" / "pip install mcp-server"), so external URLs are used at runtime to retrieve content that is then executed.