1password-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains an actual-looking service account token literal in an example and instructs setting/embedding OP_SERVICE_ACCOUNT_TOKEN in commands/CI, which requires the model to handle or output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install instructions fetch and install a remote binary at runtime via curl from https://cache.agilebits.com/dist/1P/op2/pkg/v2.29.0/op_linux_amd64_v2.29.0.zip, which downloads executable code the skill relies on and that will be run locally.