iblai-auth

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to read PLATFORM and TOKEN from iblai.env and to include the TOKEN verbatim in Authorization headers and curl/PUT commands, which requires the LLM to handle and output secret values directly (high exfiltration risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs building/installing the required CLI by cloning and running code from https://github.com/iblai/iblai-app-cli.git (git clone ... then make -C .iblai install), which fetches remote code and executes it as part of the runtime setup for the generator, so this is a runtime external dependency that can execute remote code.