testing-strategy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository contains an installation command that pipes a remote script to a shell (curl -Ls https://cli.doppler.com/install.sh | sh), which is executed during setup/runtime to install the Doppler CLI that the skill requires, so the URL https://cli.doppler.com/install.sh is a runtime external dependency that executes remote code.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the documentation for high-entropy, literal credentials. I flagged several concrete API keys present in REFERENCE.md because they are complete, random-looking keys (not obvious placeholders like YOUR_API_KEY or truncated/redacted values) and therefore meet the "secret" definition.
• The STRIPE keys (sk_test_... and pk_test_...) are explicit Stripe test-mode keys included verbatim in REFERENCE.md — high-entropy literal values, so flagged.
• I also found other explicit API keys in the same section: RESEND_API_KEY and OPENAI_API_KEY — likewise high-entropy-looking test keys and flagged.

I did NOT flag:

• Descriptive/low-entropy values such as BETTER_AUTH_SECRET=test-secret-key-min-32-chars-long or JWT_SECRET_KEY=test-jwt-secret-key (they are clearly example/placeholder-style, human-readable, low entropy).
• Simple example passwords used in tests (e.g., "testpassword") and DB URL placeholders that include the word "password" — these are low-entropy examples/placeholders and intentionally documented as test/dev values.

Files/lines below show the exact literal keys I flagged.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references a payment gateway secret key (STRIPE_SECRET_KEY) in the Doppler environment variables and calls out "payments" as security-critical code. Mentioning STRIPE_SECRET_KEY is a specific indicator of Stripe integration (a payment gateway), which qualifies as direct financial execution capability under the rules.