project-claude-config

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires the Explore subagent to return the full content of ~/.claude/settings.json (the "audit object") and to surface key-path findings, which may contain environment entries or secrets, forcing the LLM to read and output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly requires a runtime WebFetch of the catalog canonical docs (e.g. https://code.claude.com/docs/en/hooks, https://code.claude.com/docs/en/settings, https://code.claude.com/docs/en/permissions, https://code.claude.com/docs/en/memory) to validate and decide what harness/instruction proposals to show, so these external URLs are fetched at runtime and can directly influence the agent's prompts/instructions.