pp-twitch

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill shows a concrete command that stores an access token by embedding it on the command line (twitch-pp-cli auth set-token YOUR_TOKEN_HERE), which would require an LLM to include a secret value verbatim if the agent were to populate or emit that command with a real token.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes runtime installation commands that fetch and execute remote code (go install github.com/mvanhorn/printing-press-library/.../twitch-pp-cli@latest and go install github.com/mvanhorn/printing-press-library/.../twitch-pp-mcp@latest), so the skill relies on external content that is executed during setup.