opendeploy-ai-hub

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The runbook explicitly fetches and returns the real AI Hub key (e.g., via --show-secrets / provision responses) and instructs printing or pasting that token into a local .env when the user requests it, so the agent may be required to handle and output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs runtime clients to point LLM callsites at https://api.opendeploy.dev/v1 (the AI Hub base URL), which will be contacted at runtime to execute model inferences and is a required dependency for migrated apps.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly performs paid financial actions: it creates Stripe checkout sessions to top up AI Hub credits (opendeploy ai-hub credits checkout / POST /v1/topup/checkout), manages auto-recharge settings that charge a saved Stripe payment method (opendeploy ai-hub credits auto-recharge set / PUT /v1/topup/auto-recharge, including stripe_payment_method_id), and can trigger confirmed paid actions (the --confirm-paid flag and structured confirmations). These are direct payment gateway operations (Stripe) and auto-charging controls, not generic API callers, so it grants direct financial execution authority.