bulk-import

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires fetching/generating an auth token and then embedding that token (and the project ID) verbatim into the CLI command (--auth-token {TOKEN}), which forces the LLM to handle and output secret credentials.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill requires running the CLI via "npx @subframe/cli@latest import -p {PROJECT_ID} --manifest .subframe/import-design-system.json --auth-token {TOKEN}", which at runtime fetches and executes remote code from the npm registry and is required to submit the import.