webrtc-livekit

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes explicit API keys/secrets (e.g., "devkey"/"secret" and placeholders like --api-secret SECRET) and shows commands/configs that embed them verbatim, so an agent following it would need to output secret values directly in commands/code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installer uses the runtime URLs https://api.github.com/repos/livekit/livekit/releases/latest and https://api.github.com/repos/livekit/livekit-cli/releases/latest to fetch release assets (via the asset browser_download_url) which are downloaded, extracted, and can be executed locally, so it fetches and executes remote code at runtime.