pp-discord

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains explicit examples that embed live secrets into shell commands and playbook substitutions (e.g., export DISCORD_BOT_TOKEN="", discord-pp-cli auth set-token <token>, and Playbook.slots_resolved showing "token": ""), which would require the LLM to include secret values verbatim in generated output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's prerequisites/install steps reference and invoke remote Go module URLs (github.com/mvanhorn/printing-press-library/library/productivity/discord/cmd/discord-pp-cli and github.com/mvanhorn/printing-press-library/library/productivity/discord/cmd/discord-pp-mcp@latest) which fetch and execute remote code during installation and are required for the skill to run.