httpie-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes numerous examples that embed credentials verbatim (e.g., username:password, Bearer tokens, Authorization headers, API tokens, proxy user:pass), which instructs the agent to place secret values directly into commands/outputs and thus poses an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill's SKILL.md shows commands that fetch and read arbitrary public URLs (e.g., examples like https://api.github.com, https://example.com/file.zip, streaming and download examples), meaning the agent could ingest untrusted third‑party web content whose contents could influence subsequent actions.