pp-xai

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly shows using xai-pp-cli auth set-token YOUR_TOKEN_HERE, which instructs passing an API token as a command-line argument (verbatim secret in output/commands), an insecure exfiltration pattern.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite install steps fetch and execute remote code required at runtime via npx "@mvanhorn/printing-press-library" (npx -y @mvanhorn/printing-press-library install xai --cli-only) and via Go module download (go install github.com/mvanhorn/printing-press-library/library/ai/xai/cmd/xai-pp-cli@latest), and the CLI is a required dependency—both commands download and run remote code.