setup-skill-packs

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly tells the agent to "AskUserQuestion for each key" when adding MCP servers that require API keys (e.g., GitHub PAT) and to add those values into settings/config templates, which requires the LLM to receive and embed secret values verbatim into generated config — a direct exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly clones public GitHub repos (https://github.com/garrytan/gstack.git and https://github.com/affaan-m/everything-claude-code.git) and instructs the Agent to read and fix files from those repos (and use a headless browser / HTTP MCP servers), meaning untrusted, user-generated third‑party content is ingested and directly influences agent decisions and tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup fetches and runs remote code at runtime (curl -fsSL https://bun.sh/install | bash) and git-clones required skill/agent repositories (https://github.com/garrytan/gstack.git and https://github.com/affaan-m/everything-claude-code.git), where the cloned markdown files directly define agent prompts/instructions and are required dependencies—so these URLs pose an execution/control risk.