setup

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt asks the agent to request API keys and admin passwords from the user and to embed those secrets verbatim into .env files and into code/requests (e.g., credentials = {"api_key": "..."} and DIFY_EMAIL/DIFY_PASSWORD), which requires the LLM to handle and output secret values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill conditionally runs a runtime git clone of remote code (https://github.com/langgenius/dify.git) which is then started via Docker Compose (executing that fetched code), and it also makes a runtime call to the marketplace API (https://marketplace.dify.ai/api/v1/plugins/batch) to dynamically fetch plugin identifiers used to install plugins — both are runtime external dependencies that lead to executing remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The workflow instructs the agent to clone repos, run docker compose, create/modify files (including .env with credentials) and explicitly change the agent's permissions in {PROJECT_DIR}/.claude/settings.local.json to allow Bash/Read/Write—which modifies host state and grants execution privileges to the agent—so it poses a meaningful security risk even though it doesn't request sudo or create system users.