siping-house

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to execute npx commands and documents a CLI flag config --set-api-key <your-api-key> (API keys passed as command-line arguments), so the agent may need to ask for and embed a secret API key verbatim when running commands, creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires running "npx -y xiaolu-house" at runtime, which fetches and executes a remote npm package (e.g. from https://registry.npmjs.org/xiaolu-house), so it has a runtime external dependency that directly executes remote code.