secrets-management

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes hardcoded secret literals (e.g., VAULT_TOKEN='root', password=secret, "super-secret-password") and examples that echo or embed secrets verbatim, which forces the LLM to reproduce secret values in outputs/commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The workflow and CI examples fetch and execute external code at runtime (GitHub Actions and Docker images), e.g., actions/checkout@v4, hashicorp/vault-action@v2, aws-actions/configure-aws-credentials@v4, vault:latest, and trufflesecurity/trufflehog:latest which are runtime-fetched and execute remote code.