machina

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes explicit examples of passing API keys on the command line (e.g., --api-key <...>) and references non-interactive use, which encourages embedding secret values verbatim into shell commands or scripts and thus requires the LLM to handle/output secrets directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a direct raw GitHub URL to an install.sh shell script (executable content) which, while hosted on GitHub, is a direct downloadable/pipeable installer from a third-party repo and can be used to distribute malware if the repository or script is untrusted — inspect before running.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs downloading and then executing a remote installer script at https://raw.githubusercontent.com/machina-sports/machina-cli/main/install.sh (curl -o /tmp/machina-install.sh ...; bash /tmp/machina-install.sh), which fetches and runs remote code used to install the required CLI.