quiver-bootstrap

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs embedding and printing secrets verbatim (e.g., --secret KEY=VALUE on the command line, the age private key being printed, and passing --age-key "AGE-SECRET-KEY-..."), which requires the LLM to handle and output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The templated git URLs (https://${gitHost}/${org}/${repo}.git and https://${gitHost}/${org}) can point to arbitrary/untrusted git hosts or user repos that the builder will clone and may run install scripts from, making them potential malware distribution vectors; https://cli.github.com is an official vendor page and not suspicious.