pp-braze

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes an explicit example that passes an auth token directly on the command line (braze-pp-cli auth set-token YOUR_TOKEN_HERE), which would require inserting a secret verbatim into generated commands/outputs and therefore poses an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's installation instructions require fetching and installing remote Go packages that would be executed/compiled at install time (go install github.com/mvanhorn/printing-press-library/library/marketing/braze/cmd/braze-pp-cli@latest and go install github.com/mvanhorn/printing-press-library/library/marketing/braze/cmd/braze-pp-mcp@latest), and the CLI is a required runtime dependency — this means remote code is fetched and run as part of setup.