render-deploy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill instructs adding an "Authorization: Bearer <YOUR_API_KEY>" header to the MCP config and shows an example export RENDER_API_KEY="rnd_xxxxx", which implies the agent or config must include user API keys verbatim (exposing secrets in prompts/outputs/config snippets), creating an exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list contains a direct raw GitHub link to an install.sh script (curl ... | sh) which is a high-risk download pattern because executing a remote shell script can install malware if the source or contents are untrusted or tampered with.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow ingests outsider-authored free text from the user’s Git repository by analyzing the codebase (e.g., reading files like package.json, requirements.txt, etc.) to generate render.yaml and determine build/start/env vars, meaning attacker-controlled repository content is processed before any item selection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime install command that fetches and executes remote code via curl and sh (curl -fsSL https://raw.githubusercontent.com/render-oss/cli/main/bin/install.sh | sh), which downloads and runs a script during skill operation.