here-now

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs saving or passing API keys verbatim (e.g., echo "{API_KEY}" > ~/.herenow/credentials and the --api-key flag), which requires the agent to handle secret values directly and could cause secret leakage.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs the agent to fetch and read the live documentation at https://here.now/docs at runtime before answering, so the external docs (https://here.now/docs and its fragments) directly control agent instructions.