doppler

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs non-interactive agents to authenticate by exporting or passing Doppler tokens (including an inline --token example and export DOPPLER_TOKEN), which requires embedding secret token values verbatim in commands or env output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The CI snippet runs third-party GitHub Actions that fetch and execute code at runtime (notably uses: dopplerhq/cli-action@master -> https://github.com/dopplerhq/cli-action, and similar action refs like superfly/flyctl-actions/setup-flyctl@master), which installs/executes remote binaries required by the workflow.