pp-ht-ml

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill documents and exposes commands that reveal or export per-site write keys and references stored credentials (credentials.toml) and webhook delivery, so an agent using it could be required to output secret update_key values verbatim (or forward them), creating an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite installation steps explicitly run remote installers (npx -y @mvanhorn/printing-press-library install ht-ml --cli-only and go install github.com/mvanhorn/printing-press-library/library/cloud/ht-ml/cmd/ht-ml-pp-cli@latest) which fetch and execute remote code and are required for the CLI the skill depends on, so these runtime external dependencies present execution risk.