deduplicate

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes an inline shell example that requires substituting an API key into a command (COLDIQ_API_KEY= npx ...), which encourages placing a secret verbatim into generated commands/outputs and thus risks secret handling/exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs running "COLDIQ_API_KEY= npx -y @coldiq/mcp@latest" (SKILL.md:15), which fetches and executes a remote npm package at runtime, so it is a runtime external dependency that executes remote code.