deploy-web-easypanel

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). Insecure: the prompt instructs asking for SSH and DB passwords and embedding them verbatim into sshpass/scp commands and into displayed environment variables/configuration, so the agent would need to output secrets directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). Yes — the skill requires Easypanel to perform docker pull of external images at runtime (e.g., webcomunica/php-mysql-custom:8.2-apache, mysql:8.4, postgres:16), which fetches and executes remote code and thus are runtime external dependencies.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). Flagged because the skill instructs the agent to perform privileged, state-changing operations (sudo mkdir/chown/chmod, cp into /etc paths, docker exec/ps, using sshpass) that modify system files and require elevated access on the target machine.