rjv-github-image-upload

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly documents using a --token <value> CLI flag (and discusses the user_session cookie) which encourages placing a secret/session token on the command line or exposing it, creating a risk that the LLM would need to handle or emit secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires and installs the external gh extension at https://github.com/drogers0/gh-image (see the runtime install command gh extension install drogers0/gh-image), which fetches and installs remote code that the skill then executes/relies on.