cd2

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows setting an API token via a command-line argument (npx @andie/cd2 config set token ), which requires the agent to include secret values verbatim in generated commands and risks secret exposure.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs "npx @andie/cd2" during runtime, which fetches and executes remote npm package code (@andie/cd2) that the skill depends on, so it is a runtime external dependency that can execute code.