eastsword-dfyx-code-security-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds hardcoded credentials and secret strings (e.g., DB_PASS="P@ssw0rd123", SECRET_KEY="MySecretKey12345") and shows report/code examples that would cause the model to reproduce those secret values verbatim in outputs, creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The set is suspicious because it contains internal service endpoints (169.254.169.254 and localhost:6379) that are high-risk SSRF/credential-exfiltration targets plus an external GitHub repo of unknown reputation (and an unfamiliar domain), so the combination could be used to retrieve secrets or deliver/host malware.