travis-worker

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill embeds a plaintext AMQP URI with username:password in the example environment configuration (export TRAVIS_WORKER_AMQP_URI="amqp://user:pass@..."), which requires producing or handling verbatim credentials and therefore poses an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install and run instructions fetch and install remote executables/images at runtime (e.g., curl -L https://deb.travis-ci.com/key.pub, wget https://github.com/travis-ci/worker/releases/download/v13.0.0/travis-worker-linux-amd64, and docker pull travis-ci/worker:latest), which downloads and will execute remote code as a required dependency for the worker.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running sudo commands that add apt keys and sources, install packages, write to /etc files, and run systemctl to enable/start services, all of which modify the host system state and require elevated privileges.