ipfs-server

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes examples that embed secrets verbatim in commands (e.g., "ipfs pin remote service add ... YOUR_JWT") and instructs creation/handling of a swarm key, meaning the agent may be expected to include secret values directly in generated commands—an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installation instructions download and extract a Kubo tarball and run its installer (curl -O https://dist.ipfs.tech/kubo/v0.24.0/kubo_v0.24.0_darwin-amd64.tar.gz then sudo ./kubo/install.sh), which fetches remote code and executes it at runtime, creating a high-risk external dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running a sudo installer (sudo ./kubo/install.sh) and includes system-level configuration examples (gateway binding, nginx proxy) that require elevated privileges and modify the host system state.