bmap-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt explicitly instructs the agent to retrieve actual API keys (AKs) using CLI commands and embed those full, raw secret values directly into generated source code files, explicitly forbidding placeholders.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to download a binary from open-agent-cli.bj.bcebos.com via curl during setup, constituting an operational inbound external dependency from a third-party domain with weak or unverified provenance.