init-bootstrap

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly asks the user to "paste" API keys into the conversation and instructs the agent to add those keys into config files (.mcp.json, shell profile) and run setup commands, which would require the LLM to receive and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and analyzes public web pages and user-provided URLs—e.g., the "Would you like me to research your public work?" flow that "searches for information" and "[Fetches and analyzes the provided URLs]" and the Firecrawl scrape example .scripts/firecrawl-scrape.sh https://example.com—so it ingests untrusted third-party content that can influence configuration and subsequent actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The prompt instructs the agent to perform many destructive and state-changing user-space operations (rm -rf, cp -r, git init/remove remote, install packages, edit shell profiles and config files) that can modify or delete local data, but it does not request sudo/system-level actions (no user creation, systemctl/ssh or privileged changes).