shell-use

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill exposes a repeatable --env K=V CLI flag (SKILL.md:56) and records full PTY traffic / session casts (SKILL.md:306-316, SKILL.md:196-198), so an agent could be required to place secret values verbatim on the command line or type them into the session (SKILL.md:131-133), which creates a high exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow for shell-use ingestion of outsider-authored free text occurs via the shared PTY/daemon screen text that is asserted on using wait text / expect text / text / state, where the text content comes from whatever the agent runs (potentially attacker-controlled).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README and installer scripts include direct download-and-execute commands that fetch remote scripts/binaries (e.g. https://raw.githubusercontent.com/microsoft/shell-use/main/install/install.sh and the GitHub releases download URLs), which will execute remote code during installation.