postgrest-baas-builder

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill contains a bash example that embeds an API key as a command-line/env value ( -e API_KEY=ik_xxx ), which instructs including secret values verbatim in generated commands and thus enables secret exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime install commands that fetch and execute remote npm code (npx -y @insforge/mcp@latest) when adding the InsForge MCP, which downloads and runs remote code as a required tool for the skill (npx -y @insforge/mcp@latest).