freeagentidentity-chatgpt-auto-register

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's examples and API routes explicitly take and propagate secrets (API keys/tokens, proxy credentials, and account passwords), build Authorization headers with them, and even return plaintext passwords in export responses—behavior that would require an LLM following the skill to include secret values verbatim in outputs.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub URL is hosted under an unfamiliar, numeric username and is the explicit clone target for this auto-registration tool (a high-risk/abusive project that could distribute malicious code or binaries via the repo), so it represents a suspicious download source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is explicitly designed to automate large-scale ChatGPT account creation and management—using browser automation, proxy rotation, CAPTCHA/SMS solver integrations, and an export endpoint that returns account credentials—clearly enabling abusive account harvesting and evasion of detection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's installation instructions explicitly instruct cloning and then running the repository at https://github.com/asz798838958/freeAgentIdentity.git, which fetches remote code that is then executed locally, creating a direct runtime dependency on external code.