edgespeak-align

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs using and embedding license keys as command-line arguments (e.g., activate <KEY>, --license-key <KEY>), which requires the LLM or agent to include secret values verbatim in generated commands and risks secret exposure.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime path is edgespeak-cli align <audio> --text-file/--text, which ingests user-provided “reference transcript/script/lyrics text” at runtime (outsider-authored free text when supplied via the input pipeline), so the agent can be influenced before selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs users to run a remote install script via "curl -fsSL https://edgespeak.com/install.sh | sh", which fetches and executes remote code at runtime to install the required CLI dependency (edgespeak-cli), so it is a runtime external dependency that executes code.