agent-hooks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The doc and examples instruct hook scripts to echo the full offending payload into the "reason" (and to post the entire event JSON to an external LLM via the proxy), which requires the agent to read and forward secret values verbatim (API keys, tokens, seed phrases) — an explicit exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). Multiple URLs point to local/internal endpoints (loopback or internal hostnames) and an explicit .sh script plus short/obscure domains that are commonly used for exfiltration or concealed redirects, which are high-risk for SSRF, privilege escalation, or executing untrusted code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime snippet that posts events to an external LLM at "https://openrouter.ai/api/v1/chat/completions" and then uses the LLM's JSON response to decide/block actions, so this external URL is used at runtime to control agent behavior.