cloud-deployment-expert

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs writing plaintext credentials into a .env (e.g., DATABASE_URL=postgresql://user:pass@... and JWT_SECRET=your-secret-key) and shows credential-like values inline, which requires handling and potentially outputting secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup uses a runtime command that fetches and executes remote code via "curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -", which directly runs external content and is required for the Node.js installation step.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs creating a new sudo-enabled user, running commands with sudo (including piping a remote script into bash), and modifying system files (nginx config, /etc/letsencrypt), all of which change the machine state and can compromise security.