oro-k6-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs users to pass and show PASSWORD (and USERNAME) values directly on the Docker command line with -e KEY=VALUE (and includes example secret-like values), which requires the LLM to output secret values verbatim and encourages insecure handling.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). references/v6.1.md explicitly states the k6-reporter package is imported from "https://raw.githubusercontent.com/..." and "the first run downloads it from the network", which is a runtime fetch of remote code that the scripts execute/use to produce the HTML summary, so it is a required runtime external dependency executing remote code.