code-signing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes explicit secrets (private key/pkcs12 files and the cleartext password "hyperspace2024") and shows commands that embed that password and key paths verbatim, so an LLM would be required to output or reproduce secret values directly.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The package intentionally includes a PKCS#12 private key and its hard-coded password alongside helper scripts that automate signing and replacing binaries — this exposes signing credentials that allow anyone with access to impersonate the publisher and sign malicious binaries (supply‑chain/credential abuse risk).

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the skill content for literal high-entropy or otherwise usable credentials.

Flagged:

• "hyperspace2024" appears multiple times as the PKCS#12 / certificate password (in the file listing, openssl command (-passout pass:hyperspace2024), osslsigncode commands (-pass hyperspace2024), and script defaults). This is a real, specific password (not a placeholder), used to protect a private key bundle and thus provides access to the signing key.

Ignored (not flagged) with reasons:

• File names/paths (e.g., hyperspace.key, hyperspace.pfx, ~/.config/...) — these are references to files, not secrets.
• Certificate metadata (organization, CN, email, website, validity) — public certificate info.
• Timestamp server URLs and publisher URL — public endpoints.
• No private key or PEM blocks were present in the text (the private key file is referenced but not included), so nothing to flag there.
• Environment variable names and defaults other than the explicit password were considered; the only explicit secret-like value is hyperspace2024.