pp-azure-devops

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill's Auth Setup explicitly tells users to run azure-devops-pp-cli auth set-token <your-pat> (and mentions setting AZURE_DEVOPS_TOKEN), which encourages passing a Personal Access Token as a literal CLI argument—requiring the LLM/agent to handle or embed secret values verbatim (an exfiltration risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes install-time commands that fetch and execute remote code (e.g., go install github.com/mvanhorn/printing-press-library/library/developer-tools/azure-devops/cmd/azure-devops-pp-cli@latest), so the referenced GitHub module URL is a runtime external dependency that can execute code.