harbor-helm

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt contains literal credentials and example commands that embed passwords and API keys (e.g., --set harborAdminPassword=admin123, database/redis passwords, S3 access/secret keys and token placeholders), so an agent reproducing or using those examples would output secret values verbatim and risk exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The Helm commands (helm repo add https://helm.goharbor.io and helm install harbor/harbor) fetch the Helm chart from https://helm.goharbor.io and pull container images (e.g., goharbor/* and the goharbor/prepare image) at runtime, which are required dependencies that will be executed in-cluster as remote code.