setup-k8s-collection

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt asks the agent to collect an Observe ingest token (or confirm it exists) and to generate kubectl commands that include the token literally (e.g., --from-literal=OBSERVE_TOKEN=<INGEST_TOKEN>), which requires the LLM to output the secret verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's install steps instruct the user to run helm repo add/helm upgrade --install which fetches and installs the Observe helm chart from https://observeinc.github.io/helm-charts (and the referenced chart source on https://github.com/observeinc/helm-charts), so remote chart content is retrieved at runtime and executed in the cluster.