fashn

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to prompt for the user's API key and to write it into ~/.fashn/.env via a printf command containing the literal key (printf 'FASHN_API_KEY=%s\n' ''), which forces the LLM to handle and potentially output the secret verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The inline quickstart and integration paths explicitly run runtime installs like "ls ~/.fashn/node_modules/fashn 2>/dev/null || npm install --prefix ~/.fashn fashn" and the suggested "pip install fashn", which fetch packages from external registries (npm/PyPI) at runtime and then import/execute that remote code (Node/Python), so remote code is pulled and executed during skill runtime.