namecom

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs passing API credentials on the command line (e.g., --user --token ) or environment variables for non-interactive runs, which requires the agent to embed secret token values verbatim in generated commands — an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's recommended zero-install command "npx namecom-cli" fetches and executes the namecom-cli package from the npm registry at runtime (e.g. https://registry.npmjs.org/namecom-cli), so remote code is retrieved and run as a required dependency.