longhorn

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly includes a Kubernetes Secret with plaintext AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY fields (AKIA... / "..."), which requires or encourages embedding API credentials verbatim into generated output and thus creates an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs "helm repo add longhorn https://charts.longhorn.io" at runtime and then "helm install longhorn/longhorn", which fetches remote Helm charts from https://charts.longhorn.io that will be executed as installation manifests on the cluster, making this a required runtime external dependency that executes remote content.