pricing-strategy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt instructs the agent to suggest an MCP installation command that includes a placeholder API key in a header flag (--header "Authorization: Bearer key_your_api_key_here"), which demonstrates insecure credential handling patterns by advising users to pass API keys directly in command strings.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs installing an MCP server via https://mcp.credyt.ai and references setup instructions at github.com/credyt/ai-tools without established first-party provenance or integrity controls, presenting an unverifiable operational dependency.