dotenvx-secrets

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill runs the agent with real credentials in its environment and even includes examples that instruct the agent to fetch and echo secret values (relying on brittle redaction), so the LLM would need to handle and could be required to output secrets verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two 1Password links are official documentation (low risk), but https://dotenvx.sh is a standalone installer endpoint used with "curl | sh", which is a high-risk pattern for distributing malicious shell scripts or binaries from a third‑party domain.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The quickstart includes a direct install command that fetches and pipes remote code to a shell ("curl -sfS https://dotenvx.sh | sh"), which executes external code during setup/install and is therefore a high-risk runtime-executed dependency (https://dotenvx.sh).