iblai-deslop

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires scanning for and reporting hardcoded secrets (API keys, tokens, passwords, connection strings) in source and writing findings to AUDIT.md, which will lead the LLM to include secret values verbatim in its output unless additional redaction rules are specified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's audit explicitly flags DEP-001 where the code calls AutoModelForSequenceClassification.from_pretrained("vectara/hallucination_evaluation_model", trust_remote_code=True), which at runtime fetches and executes code from the Hugging Face model repo (https://huggingface.co/vectara/hallucination_evaluation_model), satisfying the criteria for a runtime external dependency that executes remote code.