pp-cloudflare

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill shows and recommends using a literal CLI command that embeds an API token (cloudflare-pp-cli auth set-token YOUR_TOKEN_HERE) and thus can require the agent/LLM to insert or emit secrets verbatim on the command line, an insecure pattern with exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). SKILL.md requires installing and running the external Printing Press package at runtime (via "npx -y @mvanhorn/printing-press-library install cloudflare --cli-only" and the Go install "go install github.com/mvanhorn/printing-press-library/library/cloud/cloudflare/cmd/cloudflare-pp-cli@latest"), which fetches and executes remote code from github.com/mvanhorn/printing-press-library (and the npm registry) and is a required runtime dependency.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)