pp-weaviate-collections

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs replaying playbook steps with slots_resolved substitutions (which can include a live token) and shows an example piping an API key into auth set-token, both of which require embedding secret token values into commands/outputs and therefore risk exposing secrets verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes install commands that fetch and install remote code required at runtime (e.g., "go install github.com/mvanhorn/printing-press-library/library/developer-tools/weaviate-collections/cmd/weaviate-collections-pp-cli@latest"), so the fetched repositories will execute code the skill relies on.