eve-compat

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt includes explicit secret-like values (sndr_123) embedded directly in CLI commands (e.g., --sender sndr_123 and npx zavudev fn secrets set SENDER_ID sndr_123), which requires the LLM to handle/output secret values verbatim and is therefore insecure.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The CLI examples show runtime importing from GitHub via "npx zavudev import owner/repo" and "owner/repo#branch", and the repo's agent/instructions.md is explicitly used as the system prompt, so fetched remote repository content directly controls agent prompts at runtime (flagged: owner/repo, owner/repo#branch).