claude-monitor
Fail
Audited by Snyk on Mar 7, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.80). These links point to an unverified personal GitHub repo and raw source/shell scripts (plus an npm npx install) that the prompt instructs you to download, compile, and execute locally—making them a potentially unsafe distribution vector unless you review the code and the publisher's trustworthiness.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The installation steps explicitly download and execute scripts from public GitHub URLs (e.g., "从 https://github.com/wangjs-jacky/.../hooks 下载" and curling the raw Swift at raw.githubusercontent.com), which are untrusted public third‑party files that the monitor will run as hooks and can therefore influence tool execution and agent behavior.
Audit Metadata