pp-home-assistant

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill's recall/playbook examples include a slots_resolved "token" and explicitly instruct replaying steps with slot substitution and printing candidate payloads (e.g., learnings confirm), which can require inserting or emitting live tokens verbatim into commands or outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs installing and running remote code as a required prerequisite (e.g., the go module path github.com/mvanhorn/printing-press-library/library/devices/home-assistant/cmd/home-assistant-pp-cli@latest used with go install, and the npx installer npx -y @mvanhorn/printing-press-library install home-assistant --cli-only), which fetches and executes external code during setup.