prisma-postgres

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes an explicit insecure pattern: a CLI example that embeds an API key as a command-line argument (prisma postgres link --api-key "<your-api-key>") and mentions updating .env with DATABASE_URL, which would require the LLM to place secret values verbatim if asked—creating exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs runtime use of "npx create-db@latest" / "npx create-pg@latest" (and references installing the create-db npm package), which fetches and executes remote code from the npm registry at runtime and is relied on for the quick provisioning workflow, so it is a runtime external dependency that executes remote code.