atproto-deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds an actual admin token string and shows commands that export and then use that token (and other API keys) in curl/CLI examples, which requires the LLM to handle and can lead it to output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This snippet exposes sensitive credentials (an inline ADMIN_TOKEN and named secrets like GitHub and API keys) and documents admin APIs that allow remote agent control (config/loop start-stop), creating a high-risk backdoor/remote-control and credential-exposure vector that could enable unauthorized access or data exfiltration.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill content for literal, high-entropy credentials.

Found one hardcoded credential:

• ADMIN_TOKEN="grimlock-admin-f5f3ef8419386713454c05b8d475cce1" — appears in the runtime curl examples and is used as a Bearer token. This is a literal token (long, random-looking hex suffix plus identifiable prefix) and is therefore treated as a real secret.

Ignored items and why:

• The various mentions of secret names (cloudflare_api_key, OPENROUTER_API_KEY, GRIMLOCK_GITHUB_TOKEN, etc.) are just environment/secret names or examples without values — treated as placeholders.
• The export commands that call a secrets lease CLI (secrets lease "atproto-agents::cloudflare_api_key" ...) do not contain actual credential values — they fetch secrets at runtime and are not hardcoded.
• Hostnames, URLs, and other config strings (agent-network.joelhooks.workers.dev, highswarm.com) are non-secrets.

Because the ADMIN_TOKEN is used directly in example API calls and is a literal high-entropy token, it qualifies as an exposed secret.