pp-linq

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's auth instructions include an explicit command that embeds a token on the command line (linq-pp-cli auth set-token YOUR_TOKEN_HERE), which would require the agent/LLM to accept and output a secret value verbatim (an insecure pattern), even though an env-var alternative is mentioned.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite installation commands (e.g., "npx -y @mvanhorn/printing-press-library install linq --cli-only" and "go install github.com/mvanhorn/printing-press-library/library/social-and-messaging/linq/cmd/linq-pp-cli@latest") fetch and execute remote code at install/runtime and are required for the skill to run, so they constitute a runtime external dependency that can execute code.