infra-postgres

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md explicitly instructs running "curl -fsSL https://clickhouse.com/cli | sh", which fetches a remote script and pipes it to sh (executes remote code at runtime), so this is a high-confidence runtime external dependency.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the 24-character random password in the local JSON output because it is a high-entropy literal value that appears to be a real credential. The README even notes command output examples were captured from real runs, increasing the chance this is an actual password rather than a generic placeholder.

I did not flag any cloud placeholders (e.g., , ), environment variable names, or simple example passwords/usernames (e.g., "postgres") because those are documentation placeholders or low-entropy defaults per the scanning rules.