omni-gateway-install

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The document includes an explicit Authorization header template ("Authorization: Bearer ") and discusses registration tokens, which requires inserting real secret token values verbatim into requests/commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The installation instructions instruct the operator to fetch and install remote packages/keys from https://flex-packages.anypoint.mulesoft.com (e.g., curl -L https://flex-packages.anypoint.mulesoft.com/ubuntu/pubkey.gpg | sudo apt-key add
• and helm repo add flex-gateway https://flex-packages.anypoint.mulesoft.com/helm), which downloads and installs remote code required at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running a privileged command (sudo chown -R $USER /usr/local/share/mulesoft/flex-gateway/conf.d) and references systemd service configuration, which directs modification of system files requiring elevated privileges.