pp-simplefin

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill shows and instructs running commands that accept a setup token as a literal CLI argument (e.g., simplefin-pp-cli auth claim <setup-token>) and references access URLs containing user:pass, which requires embedding secret tokens/credentials verbatim in commands or URLs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes explicit install commands that fetch and execute remote Go modules (e.g., github.com/mvanhorn/printing-press-library/library/payments/simplefin/cmd/simplefin-pp-cli and github.com/mvanhorn/printing-press-library/library/payments/simplefin/cmd/simplefin-pp-mcp) which are runtime-installation steps that pull and run remote code to produce required binaries.