pp-breezedoc

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows an example command that embeds a token on the command line (breezedoc-pp-cli auth set-token YOUR_TOKEN_HERE), which would require the LLM (or agent) to include secret values verbatim in generated commands if performing auth setup.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs the runtime to fetch and execute remote Go code via "go install github.com/mvanhorn/printing-press-library/library/productivity/breezedoc/cmd/breezedoc-pp-cli@latest" (and the MCP variant "go install github.com/mvanhorn/printing-press-library/library/productivity/breezedoc/cmd/breezedoc-pp-mcp@latest"), which downloads and builds remote code required for the skill to run.