security-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill instructs reviewers to flag and provide "evidence" code snippets for hardcoded secrets (e.g., api_key = "sk-...") and to report vulnerabilities with code excerpts, which would require the LLM to reproduce secret values verbatim if present in the input files.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These URLs include attacker-controlled domains and a direct shell script (.sh) URL — direct links to executables/scripts on untrusted domains are high-risk and commonly used to distribute malware.