pp-conductor

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill tells agents to replay playbook steps by substituting Playbook.slots_resolved entries (the spec even shows a "token": "") into commands and also allows inline playbook JSON, which can force the LLM to emit secret tokens verbatim into generated commands/outputs.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This URL points to a GitHub repository under a generic/unknown "example" account (not an official vendor) and could be used to host binaries or installers without provenance, so treat it as suspicious until verified.