react-dashboard

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly fetches and executes remote JavaScript at runtime (import clsx from "https://cdn.skypack.dev/clsx@1.1.1") and also sends user queries to and displays responses from the webhook https://hook.eu2.make.com/g5u9qg2bc3dsi937rlsethkc84zdm184, both of which are runtime external dependencies that execute remote code or directly control chatbot output.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The prompt contains a full Make.com webhook URL: https://hook.eu2.make.com/g5u9qg2bc3dsi937rlsethkc84zdm184. The path component (g5u9qg2bc3dsi937rlsethkc84zdm184) is a long, random-looking identifier that functions as an access token for that webhook — a high-entropy literal that would allow posting to the webhook if active. This is not a placeholder or simple setup value, so it meets the definition of a secret.

No other high-entropy credentials (API keys, private keys, or similar) are present. References to Airtable API tokens/base IDs are generic instructions (placeholders) and are ignored per the rules.