generate-bat-tests

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs passing a bearer token on the command line to scaffold the suite (and to confirm/use a URL/token provided by the user), which requires the LLM to accept and embed the secret verbatim in commands or generated files — an obvious secret-exfiltration risk despite tests themselves using config interpolation.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Two URLs are local endpoints (no external download risk) and the jqlang.github.io page is a known jq download site (low risk), but the direct S3-hosted install.sh is a remote shell script (pipe-to-bash style installer) which is a high-risk distribution vector unless its source and contents are verified, so overall this set is moderately to highly suspicious.