sprites-dev

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs the agent to fetch secrets using the 1Password CLI (op read) and pass them directly into API requests or environment variables, exposing sensitive tokens in the execution context and script templates.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to fetch and execute an arbitrary third-party dotfiles installation script from GitHub (https://raw.githubusercontent.com/kylelundstedt/dotfiles/master/install.sh), representing an unverified runtime external code dependency with common/reputable unofficial provenance.