pp-oura

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that embed bearer tokens directly in commands/HTTP headers (e.g., curl Authorization and oura-pp-cli auth set-token YOUR_TOKEN_HERE), which would require an agent to place secret values verbatim into generated commands/requests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill directs runtime installation of required binaries by fetching and executing remote code via Go install commands (e.g., "go install github.com/mvanhorn/printing-press-library/library/health/oura/cmd/oura-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/health/oura/cmd/oura-pp-mcp@latest"), so external code would be retrieved and executed to satisfy a required dependency.