agentic-top-10

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs grep for secret patterns and requires documenting "evidence" including code snippets/configurations as part of findings, which can compel the LLM to include secret values verbatim in the report.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub repository https://github.com/fabraix/playground referenced in the skill is an open-source exploit/PoC library from a relatively unknown user and could contain code or artifacts that, if downloaded and executed, would be used for offensive testing or malware-like behavior, so it should be treated as a high-risk download source; the other listed URLs are official project or vendor sites and are not suspicious download sources.