asset-import

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to obtain a short-lived import token and pass it verbatim on the command line (e.g., --token ), which requires the LLM to output a secret value directly and risks exfiltration.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill tells the agent to run helpers out of sandbox and to "install them yourself" (brew/winget/apt-get ffmpeg/ffprobe) without asking the user, which modifies the host system and may require elevated privileges.