megaview-openapi

SUSPICIOUS: the skill’s purpose and capabilities are mostly aligned, but it relies on raw local credential files, bundled database configuration, and opaque local scripts that receive those secrets. There is no clear malicious exfiltration path in the visible instructions, yet the trust model is weak enough to make this a medium-high risk skill.

This file contains hardcoded plaintext credentials and therefore presents a significant operational and supply-chain risk (credential leakage, unauthorized access). There is no executable malicious code in the fragment, but the presence of apparently real keys means they should be treated as compromised: rotate them immediately, remove from version control, and adopt secret-management best practices.

The JSON config does not contain active malicious code, but it does include high-impact sensitive information (plaintext DB credentials and internal host). This constitutes a serious secret-management issue and, if exposed, could enable unauthorized access to internal databases and data exfiltration. Recommend immediate credential rotation, moving secrets to a secure store, restricting network access to the DB, and hardening query building to avoid SQL injection.