dont-be-lazy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for tokens and passwords, and then store them in plain text files in a local vault directory, which risks exposing sensitive secrets in the agent's context and filesystem.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow involves browsing external web pages and searching for APIs via the browser or API tools, which constitutes active search/fetch of outsider-authored content.