vault

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The Quick Start explicitly shows exporting VAULT_TOKEN and demonstrates a vault kv put with a literal secret (password=s3cr3t), which requires the agent to handle or reproduce secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The install instructions fetch and install a remote Vault binary at runtime using curl to https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip (references/install-and-setup.md:31-38), which downloads executable code that is unzipped and installed/executed.