runhuman-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes explicit examples that require embedding API keys/secrets verbatim in commands or env vars (e.g., runhuman login --token <apiKey> and export RUNHUMAN_API_KEY=...) which forces an LLM to handle/output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub releases URL points to third‑party release assets (a common vector for distributing executable binaries) and should be verified for repository reputation before downloading.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly tells agents to "Fetch the comprehensive agent guide" at runtime from https://runhuman.com/for_agents_github_actions.md and "follow its instructions", meaning remote content would directly control agent behavior.