gsap-awwwards-website

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt instructs the agent to pass a Vercel authentication token as a direct command-line argument using the -t $VERCEL_TOKEN flag, which exposes the secret value in generated commands.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs cloning an unverified personal GitHub repository template at setup, constituting an operational dependency with weak/unknown publisher provenance.