cloudinary-upload

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt tells the agent to obtain the Cloudinary API key/secret (from source or by asking the user) and to export CLOUDINARY_URL containing the literal credentials (cloudinary://<api_key>:<api_secret>@...), which requires embedding secret values verbatim in shell commands or outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The upload script runs "pip3 install --user cloudinary-cli" at runtime (fetching the Cloudinary CLI from PyPI: https://pypi.org/project/cloudinary-cli), which downloads and installs remote code that is executed/relied on as a required dependency.