project-tooling

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to ask the user for their Render API key and to store it (including an example echo into .env), which requires the agent to receive and potentially output the secret verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The GitHub Actions references actions/checkout@v4, amondnet/vercel-action@v25, and supabase/setup-cli@v1 are fetched and executed by GitHub Actions at workflow runtime, so they constitute runtime external dependencies that execute remote code (actions/checkout@v4; amondnet/vercel-action@v25; supabase/setup-cli@v1).