pp-vestaboard

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill tells users to run vestaboard-pp-cli auth set-token <token>, which instructs passing an API token as a command-line argument — a pattern that requires handling the secret verbatim and can expose it via process lists/shell history.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime installation commands that fetch and execute remote Go modules (e.g., "go install github.com/mvanhorn/printing-press-library/library/devices/vestaboard/cmd/vestaboard-pp-cli@latest" and "go install github.com/mvanhorn/printing-press-library/library/devices/vestaboard/cmd/vestaboard-pp-mcp@latest"), which downloads and runs remote code required for the skill.