httpie

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains multiple examples that embed secrets directly into commands/headers (e.g., username:password, password=secret, Authorization:"Bearer $TOKEN", X-API-Key:$API_KEY), which encourages the LLM to include secret values verbatim in generated CLI invocations—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow is the bundled Bash scripts (e.g., scripts/scrape.sh and scripts/check.sh) which fetch a user-supplied URL at runtime and ingest the HTTP response body text into the script/jq/shell pipeline.