pipa-time-tracking

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to solicit/use one-time email codes and to include PIPA_API_KEY in Authorization headers (e.g., Authorization: Bearer ${PIPA_API_KEY}), which requires the model to accept and embed secret values verbatim into requests/outputs, creating a high exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes a "Top-up" mode that creates payment checkout sessions via the API (POST /v1/topups/checkout-sessions), shares checkout/billing URLs, and then acts on payment confirmation (retrying mutating requests). This is a specific payment gateway-style flow to initiate purchases (buy credits), which qualifies as direct financial execution capability.