static-site

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes command examples that embed token/passphrase values verbatim (e.g., the icp canister call issue_token with opt "my-passphrase" and the documented returned token), which would force an LLM to include secret values directly in generated commands or outputs if real secrets are substituted.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains an explicit sync plugin artifact URL that would be fetched and executed at deploy time (a runtime plugin wasm): https://github.com/dfinity/certified-assets/releases/download/migration-v2.2.1-6b48585/sync_plugin.wasm.