incidentio-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill prompt instructs users (or an agent) to pass API keys, cookies, and secret values directly into commands (e.g., auth set <api-key>, --api-key <key>, auth import '<paste curl>', and secrets create/rotate bodies), which requires the LLM to handle or echo secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The codegen step fetches external OpenAPI specs at runtime (mentions fetching docs.incident.io/llms.txt and then /openapi/tags/.json), which directly controls the generated command/instruction surface used by the skill, so these URLs are runtime dependencies: docs.incident.io/llms.txt and /openapi/tags/.json.