pp-azure-devops

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the user/agent to set AZURE_DEVOPS_TOKEN and run "azure-devops-pp-cli auth set-token ", which requires supplying the Personal Access Token verbatim on the command line or in output, creating a secret-exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires installing and running remote code at runtime via commands that fetch and execute external packages (npx -y @mvanhorn/printing-press-library install azure-devops and go install github.com/mvanhorn/printing-press-library/...@latest, plus the MCP go install github.com/mvanhorn/printing-press-library/.../azure-devops-pp-mcp@latest), which are runtime external dependencies that download and execute code the skill relies on.