macos-migration

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs collecting sensitive items (e.g., .ssh private keys, .aws/.kube credentials, keychain entries, and full crontab contents) into the migration manifest when the user consents, which would require the LLM or generated output to include secret values verbatim and thus poses an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly instructs the user at runtime to run /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)", which fetches and executes remote code from https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh and is required for subsequent steps (Homebrew-dependent operations).