vercel-automation

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes workflows to add environment variables (including secret types) where the agent must provide the env var "value" in tool calls, which would require the LLM to embed secret values verbatim in its output/requests.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires adding and using the MCP endpoint https://rube.app/mcp at runtime (call RUBE_SEARCH_TOOLS to fetch tool schemas), so external content from that URL can directly control the agent's available tools/instructions and is a required runtime dependency.