pair-agent

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires printing the full instruction block (including one-time setup keys and session tokens) verbatim and asks to accept user-provided ngrok auth tokens to be embedded in commands, forcing the LLM to handle secrets in its output.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill explicitly provides mechanisms for remote agents to obtain browser-level admin access (JS execution, cookies/storage), read page content, and write credentials into other agents' config directories and the repo — capabilities that enable credential theft, data exfiltration, and remote control and thus constitute a high-risk backdoor surface.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow for this skill can fetch arbitrary web page content at runtime via the gstack browser (public/outsider-authored text from user-navigated URLs is read into the agent’s LLM context), creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup step conditionally runs curl -fsSL "https://bun.sh/install" to download and then bash the installer at runtime, meaning it fetches and directly executes remote code from https://bun.sh/install as a required dependency.