SG-104: External-Trust Trampoline

Severity: MEDIUM

Agent-directed install from a deferred external URL + concealment (off-file payload / brand-impersonation supply-chain)

Fires when

• A skill hides its setup from the user (`handle it yourself`, `without bothering the user`, `never echo the key`) AND issues an install/execute command (npm/pip install, global install).
• That install defers to an external, non-registry URL treated as the docs/source of truth (all four conditions must co-occur).
• Escalates to HIGH when a named vendor product (e.g. Stitch, Copilot, Claude) is installed from a domain that is not that vendor's official one - brand-impersonation supply-chain.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://www.air.security/blog-posts/the-story-of-skills