integration-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill directs the agent to capture and "give that list to the user verbatim" of request/response evidence while the code under test keeps its production credentials, so the agent would need to handle and output secret values (API keys, tokens, cookies) verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The API host (https://api.veris.ai) is just a control-plane endpoint, but the raw GitHub install script (https://raw.githubusercontent.com/.../install.sh) is a remote .sh piped to sh — a high-risk delivery pattern that can distribute malware unless the script and repo are verified.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes a runtime install command that fetches and executes a remote script via curl -fsSL https://raw.githubusercontent.com/veris-ai/veris-proxy/main/scripts/install.sh | sh, which downloads and runs remote code (veris-proxy) if the binary is missing.