postcode-lookup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt's examples and required configuration explicitly embed an apiKey string (apiKey: "ak_test") in generated initialization code, which encourages providing and outputting a user's API key verbatim in code—creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's examples load and execute remote JavaScript at runtime from the jsDelivr CDN (e.g. https://cdn.jsdelivr.net/npm/@ideal-postcodes/postcode-lookup-bundled@3), which is a runtime-fetched dependency that executes code and would be required if the CDN install path is used.