tinyanalytics-dashboards

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly tells the agent to obtain the site's API key (asking the user if it's not in .env) and also to show the exact JSON before POST/PATCH/PUT, which encourages collecting and embedding a secret API key into generated requests or visible outputs (high exfiltration risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). references/api.md explicitly says the skill fetches "$ORIGIN/setup.md" at runtime and that the fetched page "wins", meaning remote content can override the agent's instructions/specs (URL: $ORIGIN/setup.md).