nnsight-remote-interpretability

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt shows and recommends directly assigning the NDIF API key in code (os.environ["NDIF_API_KEY"] = "your_key" and CONFIG.API_KEY = "your_key"), which encourages embedding secret values verbatim in generated code or outputs and therefore requires the LLM to handle secrets directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). nnsight’s remote execution mode clearly relies on the NDIF service (e.g., https://ndif.us and https://login.ndif.us) at runtime — the skill sends prompts and computations to that external API (requires an NDIF API key) which executes the model traces remotely, so it is a required runtime external dependency that directly executes prompts/code.