pp-zoho-expense

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs running an auth command that includes --client-id and --client-secret on the command line, which requires embedding secret values verbatim in generated commands (an exfiltration risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisites include go install commands that fetch and build remote code from github.com/mvanhorn/printing-press-library/.../zoho-expense-pp-cli@latest and github.com/mvanhorn/printing-press-library/.../zoho-expense-pp-mcp@latest, which downloads and executes remote code required to run the CLI.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a Zoho Expense CLI specifically designed for expense management and includes explicit commands that perform financial actions: creating/updating expenses, bundling and submitting expense reports (close --auto-submit), and marking reports as reimbursed. It also includes auth flows for OAuth tokens to the Zoho Expense API. These are specific financial-operation functions (recording/submitting reimbursements), so this grants direct financial execution authority for expense/payment workflows.