stream-flutter

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to paste API keys/tokens and instructs the agent to "hold the token in context" and "use it (and the API key) in every code snippet
• no placeholder strings," which forces the LLM to handle and output secrets verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to fetch remote documentation and migration guides (e.g. https://github.com/GetStream/stream-chat-flutter/tree/master/migrations and https://getstream.io/chat/docs/sdk/flutter/stream-chat-flutter/stream-chat-and-theming.md) and then "walk them through it step by step", meaning external content would be fetched during runtime and directly control the agent's instructions.