using-sops

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes literal secret-like values passed as command-line arguments (e.g., "pnpm secrets set ... sk_test_1") and instructs piping private keys into commands, which requires handling/outputting secrets verbatim and is high-risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup instructions contain curl lines that download and install remote binaries which are executed during environment/setup runtime (https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.amd64 and https://github.com/FiloSottile/age/releases/download/v1.3.1/age-v1.3.1-linux-amd64.tar.gz), so these URLs are runtime external dependencies that fetch and run code.