ionic-enterprise-sdk-migration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to ask the user for their license key/auth token and use it directly in an npm config set command, exposing the secret value in the LLM context and output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to configure an npm registry URL and authentication token during setup, but the specified registry and authentication endpoints are under user control and lack strong publisher provenance, making it a weak operational dependency.