polylane-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and flags that place API keys and passwords directly in CLI arguments (e.g., --api-key sk_xxxxx, --password <pw> and --api-key <key>), which requires an LLM to emit secret values verbatim in generated commands—an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The documentation links are standard and likely safe, but https://polylane.com/install.sh is a direct shell-installer URL (curl|bash) which is a high-risk distribution vector for malware if the host or the script is compromised.