commercevault-edd-commerce-orchestrator

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples and configuration that show API keys and license keys embedded verbatim (env file and MCP client JSON) and tool calls that accept a literal license_key argument, which would require the LLM/agent to handle or emit secret values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installation instructs cloning and running code from https://github.com/dhapat3927/mcp-edd-analytics-vantage.git (git clone + npm install + npm start / node src/index.js), so remote code is fetched and executed and is required for the skill to run.