universal-exam-cram-coach

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README contains explicit install commands that tell an agent to fetch and install code from the repository (e.g., "Fetch the latest release from https://github.com/ZeKaiNie/universal-examprep-skill"), which would fetch and run remote code during runtime if executed.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository text for literal high-entropy credentials (API keys, tokens, PEM blocks, long base64-like strings). I found long, random-looking "sealed_token=..." query parameters embedded in image src/srcset URLs in README files. These are high-entropy-looking strings (not placeholders like YOUR_API_KEY or short example passwords) and appear to be access tokens used by the remote image/chart service, so they meet the definition of a secret (literal, high-entropy value that can grant access).

I found no PEM/RSA private-key blocks, no "sk-..." API keys, and no other long random strings elsewhere. There are many config/flag names and example commands (these are not secrets) and many intentional placeholders and example text which I ignored per the rules.