gitnexus-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill documents a --api-key CLI flag that encourages passing an LLM API key directly on the command line (and thus embedding the secret verbatim in commands/output), which is an insecure secret-handling pattern.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). Because the required analyze workflow “parses all source files, builds the knowledge graph, writes it … and generates the AGENTS.md context file,” it can ingest free-form text from outsider-authored repository files (e.g., code/comments/docs) into the LLM-readable AGENTS.md at runtime.