google-drive-upload

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to read the user's config file and to include the script URL and apiKey in the curl POST (and even shows catting the config), which requires the LLM to handle and output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The Google Drive link is a personal file-hosting URL that can be used to distribute executables/malware and obscure origin; the other two links (msapps.mobi and the GitHub repo) are developer pages and not inherently suspicious.