aliyun-dns-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly shows configuring credentials by passing --access-key-id and --access-key-secret on the command line (and would require inserting actual key/secret values verbatim), which is an insecure pattern despite also mentioning environment variables.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install step downloads and installs a remote executable tarball at runtime (https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz), which is a required dependency and results in executing code fetched from that URL.