keeper-setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill shows and instructs using a One-Time Access Token passed directly on the command line (ksm profile init --token "US:XXXXXXXXXX"), which encourages embedding a secret verbatim in commands/outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs runtime fetching and installation of remote code (git clone https://github.com/Keeper-Security/Commander followed by pip install -r requirements.txt && pip install -e . and links to binary installers at https://github.com/Keeper-Security/secrets-manager/releases), which will download and execute external code on the host, so these URLs are runtime dependencies that can execute code.