goodissues

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for an API key interactively and then pass it as a command-line argument to the CLI tool (e.g., --api-key <key>), which exposes the secret value in the conversation and execution context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to fetch and execute an installation script from GitHub (https://raw.githubusercontent.com/agoodway/goodissues_cli/main/install.sh), which constitutes an unofficial operational dependency with weak provenance.