readme

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill tells the agent to inspect credential files and environment variables and includes copy-pasteable commands that embed secrets (e.g., -e SECRET_KEY_BASE, cat config/master.key, placeholders like sk_xxx) and even allows asking users for deployment credentials, which creates a realistic risk the LLM will output secret values verbatim.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly tells the agent to write README.md into the project root (modifying filesystem) and contains multiple commands that require or suggest using sudo/systemctl (e.g., sudo apt-get install, sudo systemctl restart), which push the agent toward privileged/state-changing operations on the host.