tinyanalytics-insights

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires obtaining the site's API key (ask the user if not in .env) and instructs using it in an Authorization: Bearer header, which forces the agent to accept and embed secret values in requests or generated outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly states it will fetch $ORIGIN/setup.md at runtime and that "the fetched page wins", meaning external content at $ORIGIN/setup.md can override or control agent instructions (flagged URL: $ORIGIN/setup.md).