skaffold-standards
Fail
Audited by Snyk on Feb 27, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.90). Both domains appear to be third‑party/brandable sites (not an established vendor) and the skill instructs using a direct shell installer (curl https://dotenvx.sh | sh), which executes remote code from an unverified source and is therefore a high‑risk vector for malware.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The SKILL includes a setup step that runs "curl -sfS https://dotenvx.sh | sh" which fetches and executes remote installer code and the skill's runtime hooks call "dotenvx run ...", making https://dotenvx.sh a runtime external dependency that can execute code.
Audit Metadata