cloudflare-temporary-deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires parsing and returning the claim URL (which contains a claimToken that grants ownership) and instructs the agent to hand that URL to the user, which forces the LLM to output a sensitive secret verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes "npx wrangler@latest" (which fetches and runs the Wrangler package from the npm registry, e.g. https://registry.npmjs.org/) at runtime to perform deployments, meaning remote code is downloaded and executed and is required for the skill to work.