basercms4-to-5-upgrade

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to request DB credentials and other secrets from the user and includes examples that embed those secrets verbatim on the command line (e.g. --password) and to copy SECURITY_SALT, which requires handling secret values directly—an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime commands to fetch and install remote code (curl to "https://basercms.net/packages/download_exec/basercms-x.x.x.zip" / "https://basercms.net/packages/download_exec/basercms-<x.x.x>.zip" and a git clone from "https://github.com/baserproject/BcDbMigrator.git"), which will retrieve and execute external code that the migration flow depends on.