pp-xai

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes an explicit example that passes an API token as a command-line argument ("xai-pp-cli auth set-token YOUR_TOKEN_HERE"), which would require the agent/LLM to include a secret verbatim in generated commands — an insecure pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires installing and running a remote-distributed CLI via commands that fetch and execute remote code at runtime (e.g., "npx -y @mvanhorn/printing-press-library install xai --cli-only" and "go install github.com/mvanhorn/printing-press-library/library/ai/xai/cmd/xai-pp-cli@latest"), so the installation step pulls and runs external code that the skill depends on.