here-now

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs embedding secrets verbatim in generated shell commands and HTTP headers (e.g., echo "{API_KEY}" > ~/.herenow/credentials and using Authorization: Bearer ), which requires the LLM to handle/output secret values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill explicitly instructs the agent to fetch and use the live documentation at https://here.now/docs at runtime (e.g., "Before answering... read the current docs"), meaning that external content can directly control agent prompts/behavior.